Falhas do tipo CWE-457

293 resultados

Uso de variável não inicializada

Quando o código usa uma variável antes de atribuir um valor válido a ela, o programa pode ler lixo de memória (valores aleatórios deixados por outras operações). Isso leva a comportamentos imprevisíveis, falhas, ou no pior caso, a exploração de segurança quando o atacante consegue controlar o que está naquela posição de memória.

Exemplo

Um buffer local declarado em C sem inicialização (char buf[256];) é usado logo depois em memcpy ou sprintf. Se o conteúdo anterior daquela pilha contiver dados sensíveis ou endereços, um vazamento de informação ou corrupção de fluxo de controle pode ocorrer.

Como mitigar

Inicialize sempre as variáveis na declaração (char buf[256] = {0}; ou int x = 0;). Use análise estática (linters, compiler warnings, ferramentas como clang-analyzer) para detectar uso de variáveis não inicializadas antes do deploy. Em linguagens gerenciadas como Java/C#, o compilador já força isso.

CVE-2026-17740MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML paEPSS 0.4%CVE-2026-17757MEDIUMUninitialized Use in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pagEPSS 0.4%CVE-2025-9181MEDIUMUninitialized memory in the JavaScript Engine componentEPSS 0.4%CVE-2026-17771MEDIUMUninitialized Use in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pagEPSS 0.4%CVE-2024-37002HIGHMultiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareEPSS 0.4%CVE-2026-117952HIGHUninitialized memory in the Networking componentEPSS 0.4%CVE-2026-84564MEDIUMAn uninitialized memory issue was addressed with improved memory initialization. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 andEPSS 0.4%CVE-2026-113120HIGHUse of uninitialized variable in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside tEPSS 0.4%CVE-2023-25585MEDIUMField `file_table` of `struct module *module` is uninitializedEPSS 0.4%CVE-2026-62986MEDIUMOpenEXR: PyOpenEXR deep prefixed RGB stale lane disclosureEPSS 0.4%CVE-2024-8842HIGHPDF-XChange Editor RTF File Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.4%CVE-2023-25588MEDIUMField `the_bfd` of `asymbol` is uninitialized in function `bfd_mach_o_get_synthetic_symtab`EPSS 0.4%CVE-2026-13971MEDIUMUninitialized Use in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtaEPSS 0.4%CVE-2026-13833MEDIUMUninitialized Use in ANGLE in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted EPSS 0.4%CVE-2026-43139HIGHxfrm6: fix uninitialized saddr in xfrm6_get_saddr()EPSS 0.4%CVE-2026-17790MEDIUMUninitialized Use in ANGLE in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive infoEPSS 0.4%CVE-2026-34608MEDIUMnanomq: Heap-Buffer-Overflow in webhook_inproc.c via cJSON_Parse OOB ReadEPSS 0.4%CVE-2026-68907HIGHlibIEC61850: Server-side out-of-bounds stack read in association-specific dynamic dataset creation due to reversed StringUtils_copyStringToBuffer argumentsEPSS 0.4%CVE-2025-58071HIGHBIG-IP IPSec vulnerabilityEPSS 0.4%CVE-2024-7022HIGHUninitialized Use in V8 in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform out of bounds memory access via a craftEPSS 0.4%