Falhas do tipo CWE-457

293 resultados

Uso de variável não inicializada

Quando o código usa uma variável antes de atribuir um valor válido a ela, o programa pode ler lixo de memória (valores aleatórios deixados por outras operações). Isso leva a comportamentos imprevisíveis, falhas, ou no pior caso, a exploração de segurança quando o atacante consegue controlar o que está naquela posição de memória.

Exemplo

Um buffer local declarado em C sem inicialização (char buf[256];) é usado logo depois em memcpy ou sprintf. Se o conteúdo anterior daquela pilha contiver dados sensíveis ou endereços, um vazamento de informação ou corrupção de fluxo de controle pode ocorrer.

Como mitigar

Inicialize sempre as variáveis na declaração (char buf[256] = {0}; ou int x = 0;). Use análise estática (linters, compiler warnings, ferramentas como clang-analyzer) para detectar uso de variáveis não inicializadas antes do deploy. Em linguagens gerenciadas como Java/C#, o compilador já força isso.

CVE-2025-20271HIGHCisco Meraki MX and Z Series AnyConnect VPN with Client Certificate Authentication Denial of Service VulnerabilityEPSS 0.5%CVE-2024-29838HIGHUnsanitised variable on DAL_ADD in Evolution Controller causes application level denial of service and crashEPSS 0.5%CVE-2026-16141HIGHOpenBMC IPMI Authentication Bypass via Default userKey and Stale Challenge ValueEPSS 0.5%CVE-2026-17667MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML paEPSS 0.5%CVE-2026-17668MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML paEPSS 0.5%CVE-2026-17714MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information froEPSS 0.5%CVE-2026-78935CRITICALUse of uninitialized variable in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to potentially execute aEPSS 0.5%CVE-2026-14405CRITICALUninitialized Use in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a cEPSS 0.5%CVE-2026-52931CRITICALbatman-adv: tp_meter: avoid use of uninit sender varsEPSS 0.5%CVE-2026-17077MEDIUMIBM i is Affected By Multiple Vulnerabilities in DRDA / DDMEPSS 0.5%CVE-2025-40575MEDIUMA vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices do not properly valEPSS 0.5%CVE-2026-113030HIGHUse of uninitialized variable in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sEPSS 0.5%CVE-2023-42062HIGHPDF-XChange Editor U3D File Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-19212MEDIUMWonderTrader TraderATP Cash Trade Conversion WTSTradeDef.hpp uninitialized variableEPSS 0.5%CVE-2023-42056LOWPDF-XChange Editor U3D File Parsing Uninitialized Variable Information Disclosure VulnerabilityEPSS 0.5%CVE-2023-42046LOWPDF-XChange Editor J2K File Parsing Uninitialized Variable Information Disclosure VulnerabilityEPSS 0.5%CVE-2026-17689MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML paEPSS 0.5%CVE-2026-15132HIGHUninitialized Use in V8 in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a EPSS 0.5%CVE-2026-2806CRITICALUninitialized memory in the Graphics: Text componentEPSS 0.4%CVE-2023-39484LOWPDF-XChange Editor PDF File Parsing Uninitialized Variable Information Disclosure VulnerabilityEPSS 0.4%