Falhas do tipo CWE-457

245 resultados

Uso de variável não inicializada

Quando o código usa uma variável antes de atribuir um valor válido a ela, o programa pode ler lixo de memória (valores aleatórios deixados por outras operações). Isso leva a comportamentos imprevisíveis, falhas, ou no pior caso, a exploração de segurança quando o atacante consegue controlar o que está naquela posição de memória.

Exemplo

Um buffer local declarado em C sem inicialização (char buf[256];) é usado logo depois em memcpy ou sprintf. Se o conteúdo anterior daquela pilha contiver dados sensíveis ou endereços, um vazamento de informação ou corrupção de fluxo de controle pode ocorrer.

Como mitigar

Inicialize sempre as variáveis na declaração (char buf[256] = {0}; ou int x = 0;). Use análise estática (linters, compiler warnings, ferramentas como clang-analyzer) para detectar uso de variáveis não inicializadas antes do deploy. Em linguagens gerenciadas como Java/C#, o compilador já força isso.

CVE-2023-34310HIGHAshlar-Vellum Cobalt Uninitialized Memory Remote Code Execution VulnerabilityEPSS 0.4%CVE-2023-50188HIGHTrimble SketchUp Viewer SKP File Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-17759MEDIUMUninitialized Use in Codecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information frEPSS 0.4%CVE-2024-32625MEDIUMUninitialized scalar fieldEPSS 0.4%CVE-2026-6748CRITICALUninitialized memory in the Audio/Video: Web Codecs componentEPSS 0.4%CVE-2026-16141HIGHOpenBMC IPMI Authentication Bypass via Default userKey and Stale Challenge ValueEPSS 0.4%CVE-2024-7868LOWUninitialized variable in Xpdf 4.05 due to invalid JPEG headerEPSS 0.4%CVE-2026-2806CRITICALUninitialized memory in the Graphics: Text componentEPSS 0.4%CVE-2024-37002HIGHMultiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareEPSS 0.4%CVE-2025-53644MEDIUMOpenCV contains a use after free buffer write due to an uninitialized pointerEPSS 0.4%CVE-2026-19160LOWUninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leaEPSS 0.4%CVE-2026-15770MEDIUMUninitialized Use in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to obtain potentially sensitive information from EPSS 0.4%CVE-2025-64181LOWOpenEXR Makes Use of Uninitialized MemoryEPSS 0.4%CVE-2026-15766MEDIUMUninitialized Use in Skia in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to obtain potentially sensitive information froEPSS 0.4%CVE-2024-8842HIGHPDF-XChange Editor RTF File Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.4%CVE-2023-25585MEDIUMField `file_table` of `struct module *module` is uninitializedEPSS 0.4%CVE-2025-2520HIGHDereferencing of an uninitialized pointer leads to denial of service.EPSS 0.4%CVE-2023-25588MEDIUMField `the_bfd` of `asymbol` is uninitialized in function `bfd_mach_o_get_synthetic_symtab`EPSS 0.4%CVE-2026-17810MEDIUMUninitialized Use in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pagEPSS 0.4%CVE-2026-17757MEDIUMUninitialized Use in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pagEPSS 0.4%