Falhas do tipo CWE-457

245 resultados

Uso de variável não inicializada

Quando o código usa uma variável antes de atribuir um valor válido a ela, o programa pode ler lixo de memória (valores aleatórios deixados por outras operações). Isso leva a comportamentos imprevisíveis, falhas, ou no pior caso, a exploração de segurança quando o atacante consegue controlar o que está naquela posição de memória.

Exemplo

Um buffer local declarado em C sem inicialização (char buf[256];) é usado logo depois em memcpy ou sprintf. Se o conteúdo anterior daquela pilha contiver dados sensíveis ou endereços, um vazamento de informação ou corrupção de fluxo de controle pode ocorrer.

Como mitigar

Inicialize sempre as variáveis na declaração (char buf[256] = {0}; ou int x = 0;). Use análise estática (linters, compiler warnings, ferramentas como clang-analyzer) para detectar uso de variáveis não inicializadas antes do deploy. Em linguagens gerenciadas como Java/C#, o compilador já força isso.

CVE-2025-13763MEDIUMLibopensc: opensc: multiple uses of uninitialized variableEPSS 0.2%CVE-2025-9450HIGHUse of Uninitialized Variable vulnerability affecting the JT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025EPSS 0.2%CVE-2026-13940MEDIUMUninitialized Use in Cast in Google Chrome prior to 150.0.7871.47 allowed an attacker on the local network segment to obtain potentially senEPSS 0.2%CVE-2022-34390HIGHDell BIOS contains a use of uninitialized variable vulnerability. A local authenticated malicious user may potentially exploit this vulnerabEPSS 0.2%CVE-2026-65405MEDIUMA memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOEPSS 0.2%CVE-2025-6974HIGHUse of Uninitialized Variable vulnerability exists in the JT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025EPSS 0.2%CVE-2026-20051HIGHCisco Nexus 3600-R and 9500-R Series Switching Platforms Layer 2 Loop Denial of Service VulnerabilityEPSS 0.2%CVE-2025-10021HIGHA Use of Uninitialized Variable vulnerability exists in Open Design Alliance Drawings SDK static versions (mt) before 2026.12. Static objectEPSS 0.2%CVE-2025-29952MEDIUMImproper Initialization within the AMD Secure Encrypted Virtualization (SEV) firmware can allow an admin privileged attacker to corrupt RMP EPSS 0.1%CVE-2023-31326LOWUse of an uninitialized variable in the ASP could allow an attacker to access leftover data from a trusted execution environment (TEE) driveEPSS 0.1%CVE-2026-15168LOWUse of Uninitialized Variable in WiresharkEPSS 0.1%CVE-2024-33021HIGHUse of Uninitialized Variable in Automotive GPUEPSS 0.1%CVE-2025-32467MEDIUMUse of uninitialized variable for some TDX Module before version tdx1.5 within Ring 0: Hypervisor may allow an information disclosure. AuthoEPSS 0.1%CVE-2025-20638MEDIUMIn DA, there is a possible read of uninitialized heap data due to uninitialized data. This could lead to local information disclosure, if anEPSS 0.1%CVE-2022-33716LOWAn absence of variable initialization in ICCC TA prior to SMR Aug-2022 Release 1 allows local attacker to read uninitialized memory.EPSS 0.1%CVE-2026-47336LOWUse of uninitialized value in Ubuntu Linux AppArmor IPv4/IPv6 socket mediation rulesEPSS 0.1%CVE-2026-47330LOWUse of uninitialized value in Ubuntu Linux AppArmor notification handlingEPSS 0.1%CVE-2025-26448MEDIUMIn writeToParcel of CursorWindow.cpp, there is a possible out of bounds read due to uninitialized data. This could lead to local informationEPSS 0.1%CVE-2025-20771MEDIUMIn display, there is a possible escalation of privilege due to improper input validation. This could lead to local escalation of privilege iEPSS 0.1%CVE-2025-20784MEDIUMIn display, there is a possible memory corruption due to uninitialized data. This could lead to local escalation of privilege if a maliciousEPSS 0.1%