Falhas do tipo CWE-457

245 resultados

Uso de variável não inicializada

Quando o código usa uma variável antes de atribuir um valor válido a ela, o programa pode ler lixo de memória (valores aleatórios deixados por outras operações). Isso leva a comportamentos imprevisíveis, falhas, ou no pior caso, a exploração de segurança quando o atacante consegue controlar o que está naquela posição de memória.

Exemplo

Um buffer local declarado em C sem inicialização (char buf[256];) é usado logo depois em memcpy ou sprintf. Se o conteúdo anterior daquela pilha contiver dados sensíveis ou endereços, um vazamento de informação ou corrupção de fluxo de controle pode ocorrer.

Como mitigar

Inicialize sempre as variáveis na declaração (char buf[256] = {0}; ou int x = 0;). Use análise estática (linters, compiler warnings, ferramentas como clang-analyzer) para detectar uso de variáveis não inicializadas antes do deploy. Em linguagens gerenciadas como Java/C#, o compilador já força isso.

CVE-2026-17810MEDIUMUninitialized Use in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pagEPSS 0.4%CVE-2026-17790MEDIUMUninitialized Use in ANGLE in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive infoEPSS 0.4%CVE-2026-17785MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML paEPSS 0.4%CVE-2026-17757MEDIUMUninitialized Use in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pagEPSS 0.4%CVE-2026-17771MEDIUMUninitialized Use in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pagEPSS 0.4%CVE-2026-17740MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML paEPSS 0.4%CVE-2024-7022HIGHUninitialized Use in V8 in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform out of bounds memory access via a craftEPSS 0.4%CVE-2025-58071HIGHBIG-IP IPSec vulnerabilityEPSS 0.4%CVE-2025-0081HIGHIn dng_lossless_decoder::HuffDecode of dng_lossless_jpeg.cpp, there is a possible way to cause a crash due to uninitialized data. This couldEPSS 0.4%CVE-2025-9181MEDIUMUninitialized memory in the JavaScript Engine componentEPSS 0.4%CVE-2026-34608MEDIUMnanomq: Heap-Buffer-Overflow in webhook_inproc.c via cJSON_Parse OOB ReadEPSS 0.4%CVE-2024-45616LOWLibopensc: uninitialized values after incorrect check or usage of apdu response values in libopenscEPSS 0.4%CVE-2024-45615LOWLibopensc: pkcs15init: usage of uninitialized values in libopensc and pkcs15initEPSS 0.4%CVE-2025-59348MEDIUMDragonfly incorrectly handles a task structure’s usedTraffic fieldEPSS 0.4%CVE-2026-17077MEDIUMIBM i is Affected By Multiple Vulnerabilities in DRDA / DDMEPSS 0.4%CVE-2022-25737HIGHUse of Uninitialized Variable in MODEMEPSS 0.4%CVE-2021-34953HIGHFoxit PDF Reader Annotation Use of Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.3%CVE-2026-19146MEDIUMUninitialized Use in GPU in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer procEPSS 0.3%CVE-2026-15109MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to obtain potentially sensitive information frEPSS 0.3%CVE-2026-14421MEDIUMUninitialized Use in Dawn in Google Chrome on ChromeOS prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive infoEPSS 0.3%