Falhas do tipo CWE-457

245 resultados

Uso de variável não inicializada

Quando o código usa uma variável antes de atribuir um valor válido a ela, o programa pode ler lixo de memória (valores aleatórios deixados por outras operações). Isso leva a comportamentos imprevisíveis, falhas, ou no pior caso, a exploração de segurança quando o atacante consegue controlar o que está naquela posição de memória.

Exemplo

Um buffer local declarado em C sem inicialização (char buf[256];) é usado logo depois em memcpy ou sprintf. Se o conteúdo anterior daquela pilha contiver dados sensíveis ou endereços, um vazamento de informação ou corrupção de fluxo de controle pode ocorrer.

Como mitigar

Inicialize sempre as variáveis na declaração (char buf[256] = {0}; ou int x = 0;). Use análise estática (linters, compiler warnings, ferramentas como clang-analyzer) para detectar uso de variáveis não inicializadas antes do deploy. Em linguagens gerenciadas como Java/C#, o compilador já força isso.

CVE-2026-10008MEDIUMUninitialized Use in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive inforEPSS 0.2%CVE-2026-9754HIGHStack memory disclosure in filemd5 commandEPSS 0.2%CVE-2026-16417LOWUninitialized Use in Skia in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to leaEPSS 0.2%CVE-2026-11159MEDIUMUninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML pagEPSS 0.2%CVE-2026-17949MEDIUMUninitialized Use in GPU in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafteEPSS 0.2%CVE-2025-7984HIGHAshlar-Vellum Cobalt AR File Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.2%CVE-2026-4147HIGHStack memory disclosure in filemd5 commandEPSS 0.2%CVE-2026-9920LOWUninitialized Use in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer procEPSS 0.2%CVE-2025-5749MEDIUMWOLFBOX Level 2 EV Charger BLE Encryption Keys Uninitialized Variable Authentication Bypass VulnerabilityEPSS 0.2%CVE-2024-56446MEDIUMVulnerability of variables not being initialized in the notification module Impact: Successful exploitation of this vulnerability may affectEPSS 0.2%CVE-2026-8020MEDIUMUninitialized Use in GPU in Google Chrome on Android prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer proceEPSS 0.2%CVE-2026-64699MEDIUMA memory initialization issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8,EPSS 0.2%CVE-2026-22188MEDIUMPanda3D <= 1.10.16 Deploy-Stub Stack Exhaustion via Unbounded alloca()EPSS 0.2%CVE-2026-1333HIGHUse of Uninitialized Variable vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026EPSS 0.2%CVE-2026-9942MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to byEPSS 0.2%CVE-2026-9944LOWUninitialized Use in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to leEPSS 0.2%CVE-2026-11668MEDIUMUninitialized Use in Codecs in Google Chrome on Linux, ChromeOS prior to 149.0.7827.103 allowed a remote attacker to leak cross-origin data EPSS 0.2%CVE-2026-11696MEDIUMUninitialized Use in Video in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer prEPSS 0.2%CVE-2026-12469MEDIUMUninitialized Use in GPU in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to leak cross-origin data via a craftEPSS 0.2%CVE-2025-5047HIGHDGN File Parsing Uninitialized Variable VulnerabilityEPSS 0.2%