Falhas do tipo CWE-457

245 resultados

Uso de variável não inicializada

Quando o código usa uma variável antes de atribuir um valor válido a ela, o programa pode ler lixo de memória (valores aleatórios deixados por outras operações). Isso leva a comportamentos imprevisíveis, falhas, ou no pior caso, a exploração de segurança quando o atacante consegue controlar o que está naquela posição de memória.

Exemplo

Um buffer local declarado em C sem inicialização (char buf[256];) é usado logo depois em memcpy ou sprintf. Se o conteúdo anterior daquela pilha contiver dados sensíveis ou endereços, um vazamento de informação ou corrupção de fluxo de controle pode ocorrer.

Como mitigar

Inicialize sempre as variáveis na declaração (char buf[256] = {0}; ou int x = 0;). Use análise estática (linters, compiler warnings, ferramentas como clang-analyzer) para detectar uso de variáveis não inicializadas antes do deploy. Em linguagens gerenciadas como Java/C#, o compilador já força isso.

CVE-2024-31636LOWAn issue in LIEF v.0.14.1 allows a local attacker to obtain sensitive information via the name parameter of the machd_reader.c component.EPSS 0.2%CVE-2026-7982MEDIUMUninitialized Use in WebCodecs in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to obtain potentially sensitive informationEPSS 0.2%CVE-2026-7924MEDIUMUninitialized Use in Dawn in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to obtain potentially sensitive information fromEPSS 0.2%CVE-2026-9921MEDIUMUninitialized Use in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin information viEPSS 0.2%CVE-2026-9935MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML pEPSS 0.2%CVE-2026-7972MEDIUMUninitialized Use in GPU in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to leak EPSS 0.2%CVE-2026-84391MEDIUMA use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 through 7.6.6 may allow attacker to denial of service via <insEPSS 0.2%CVE-2025-7978HIGHAshlar-Vellum Graphite VC6 File Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.2%CVE-2025-7981HIGHAshlar-Vellum Graphite VC6 File Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.2%CVE-2026-17889MEDIUMUninitialized Use in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML paEPSS 0.2%CVE-2025-65295HIGHMultiple vulnerabilities in Aqara Hub firmware update process in the Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 deviEPSS 0.2%CVE-2026-62986MEDIUMOpenEXR: PyOpenEXR deep prefixed RGB stale lane disclosureEPSS 0.2%CVE-2022-2308—A flaw was found in vDPA with VDUSE backend. There are currently no checks in VDUSE kernel driver to ensure the size of the device config spEPSS 0.2%CVE-2026-17858MEDIUMUninitialized Use in WebNN in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafEPSS 0.2%CVE-2025-1650HIGHCATPRODUCT File Parsing Uninitialized Variable VulnerabilityEPSS 0.2%CVE-2025-1649HIGHCATPRODUCT File Parsing Uninitialized Variable VulnerabilityEPSS 0.2%CVE-2024-10204HIGHHeap-based Buffer Overflow and Uninitialized Variable vulnerabilities exist in eDrawings from Release SOLIDWORKS 2024 through Release SOLIDWORKS 2025EPSS 0.2%CVE-2026-21690MEDIUMiccDEV has Type Confusion in CIccTagXmlTagData::ToXml()EPSS 0.2%CVE-2026-26824MEDIUMlibxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser. Memory allocated for the MastEPSS 0.2%CVE-2026-9972HIGHUninitialized Use in Gamepad in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer procEPSS 0.2%