Falhas do tipo CWE-457

293 resultados

Uso de variável não inicializada

Quando o código usa uma variável antes de atribuir um valor válido a ela, o programa pode ler lixo de memória (valores aleatórios deixados por outras operações). Isso leva a comportamentos imprevisíveis, falhas, ou no pior caso, a exploração de segurança quando o atacante consegue controlar o que está naquela posição de memória.

Exemplo

Um buffer local declarado em C sem inicialização (char buf[256];) é usado logo depois em memcpy ou sprintf. Se o conteúdo anterior daquela pilha contiver dados sensíveis ou endereços, um vazamento de informação ou corrupção de fluxo de controle pode ocorrer.

Como mitigar

Inicialize sempre as variáveis na declaração (char buf[256] = {0}; ou int x = 0;). Use análise estática (linters, compiler warnings, ferramentas como clang-analyzer) para detectar uso de variáveis não inicializadas antes do deploy. Em linguagens gerenciadas como Java/C#, o compilador já força isso.

CVE-2025-7981HIGHAshlar-Vellum Graphite VC6 File Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.2%CVE-2025-65295HIGHMultiple vulnerabilities in Aqara Hub firmware update process in the Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 deviEPSS 0.2%CVE-2022-2308—A flaw was found in vDPA with VDUSE backend. There are currently no checks in VDUSE kernel driver to ensure the size of the device config spEPSS 0.2%CVE-2026-21690MEDIUMiccDEV has Type Confusion in CIccTagXmlTagData::ToXml()EPSS 0.2%CVE-2026-11159MEDIUMUninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML pagEPSS 0.2%CVE-2026-1333HIGHUse of Uninitialized Variable vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026EPSS 0.2%CVE-2026-55280HIGHIn multiple locations, there is a possible out-of-bounds write due to uninitialized data. This could lead to remote escalation of privilege EPSS 0.2%CVE-2025-1650HIGHCATPRODUCT File Parsing Uninitialized Variable VulnerabilityEPSS 0.2%CVE-2025-1649HIGHCATPRODUCT File Parsing Uninitialized Variable VulnerabilityEPSS 0.2%CVE-2024-10204HIGHHeap-based Buffer Overflow and Uninitialized Variable vulnerabilities exist in eDrawings from Release SOLIDWORKS 2024 through Release SOLIDWORKS 2025EPSS 0.2%CVE-2026-4147HIGHStack memory disclosure in filemd5 commandEPSS 0.2%CVE-2026-9972HIGHUninitialized Use in Gamepad in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer procEPSS 0.2%CVE-2026-10008MEDIUMUninitialized Use in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive inforEPSS 0.2%CVE-2026-14402MEDIUMUninitialized Use in ANGLE in Google Chrome on Windows prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive infoEPSS 0.2%CVE-2026-9754HIGHStack memory disclosure in filemd5 commandEPSS 0.2%CVE-2025-5749MEDIUMWOLFBOX Level 2 EV Charger BLE Encryption Keys Uninitialized Variable Authentication Bypass VulnerabilityEPSS 0.2%CVE-2025-7984HIGHAshlar-Vellum Cobalt AR File Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.2%CVE-2026-14413HIGHUninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potEPSS 0.2%CVE-2026-9920LOWUninitialized Use in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer procEPSS 0.2%CVE-2026-9942MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to byEPSS 0.2%