Falhas do tipo CWE-457

293 resultados

Uso de variável não inicializada

Quando o código usa uma variável antes de atribuir um valor válido a ela, o programa pode ler lixo de memória (valores aleatórios deixados por outras operações). Isso leva a comportamentos imprevisíveis, falhas, ou no pior caso, a exploração de segurança quando o atacante consegue controlar o que está naquela posição de memória.

Exemplo

Um buffer local declarado em C sem inicialização (char buf[256];) é usado logo depois em memcpy ou sprintf. Se o conteúdo anterior daquela pilha contiver dados sensíveis ou endereços, um vazamento de informação ou corrupção de fluxo de controle pode ocorrer.

Como mitigar

Inicialize sempre as variáveis na declaração (char buf[256] = {0}; ou int x = 0;). Use análise estática (linters, compiler warnings, ferramentas como clang-analyzer) para detectar uso de variáveis não inicializadas antes do deploy. Em linguagens gerenciadas como Java/C#, o compilador já força isso.

CVE-2026-11268MEDIUMUninitialized Use in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafEPSS 0.3%CVE-2026-11033MEDIUMUninitialized Use in WebML in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive informatEPSS 0.3%CVE-2026-11141MEDIUMUninitialized Use in Audio in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtEPSS 0.3%CVE-2026-100806MEDIUMUninitialized memory in the Graphics: WebGPU componentEPSS 0.2%CVE-2025-1427HIGHCATPRODUCT File Parsing Uninitialized Variable VulnerabilityEPSS 0.2%CVE-2024-47966HIGHUse of Uninitialized Variable vulnerability in Delta Electronics CNCSoft-G2EPSS 0.2%CVE-2026-55990MEDIUMPacket of death for a DNSCrypt misconfigured UnboundEPSS 0.2%CVE-2026-100799MEDIUMUninitialized memory in the Graphics: WebGPU componentEPSS 0.2%CVE-2026-100802MEDIUMUninitialized memory in the Graphics: WebGPU componentEPSS 0.2%CVE-2025-26383MEDIUMThe iSTAR Configuration Utility (ICU) tool leaks memory, which could result in the unintended exposure of unauthorized data from the WindowsEPSS 0.2%CVE-2024-31636LOWAn issue in LIEF v.0.14.1 allows a local attacker to obtain sensitive information via the name parameter of the machd_reader.c component.EPSS 0.2%CVE-2026-7955MEDIUMUninitialized Use in GPU in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to obtaiEPSS 0.2%CVE-2026-7924MEDIUMUninitialized Use in Dawn in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to obtain potentially sensitive information fromEPSS 0.2%CVE-2026-7982MEDIUMUninitialized Use in WebCodecs in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to obtain potentially sensitive informationEPSS 0.2%CVE-2026-92052HIGHPrivilege escalation due to uninitialized memory in the Graphics: CanvasWebGL componentEPSS 0.2%CVE-2026-9921MEDIUMUninitialized Use in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin information viEPSS 0.2%CVE-2026-95332MEDIUMUse of uninitialized variable in Tint in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to read memory outsideEPSS 0.2%CVE-2026-7972MEDIUMUninitialized Use in GPU in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to leak EPSS 0.2%CVE-2026-16417LOWUninitialized Use in Skia in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to leaEPSS 0.2%CVE-2025-7978HIGHAshlar-Vellum Graphite VC6 File Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.2%