Falhas do tipo CWE-457

293 resultados

Uso de variável não inicializada

Quando o código usa uma variável antes de atribuir um valor válido a ela, o programa pode ler lixo de memória (valores aleatórios deixados por outras operações). Isso leva a comportamentos imprevisíveis, falhas, ou no pior caso, a exploração de segurança quando o atacante consegue controlar o que está naquela posição de memória.

Exemplo

Um buffer local declarado em C sem inicialização (char buf[256];) é usado logo depois em memcpy ou sprintf. Se o conteúdo anterior daquela pilha contiver dados sensíveis ou endereços, um vazamento de informação ou corrupção de fluxo de controle pode ocorrer.

Como mitigar

Inicialize sempre as variáveis na declaração (char buf[256] = {0}; ou int x = 0;). Use análise estática (linters, compiler warnings, ferramentas como clang-analyzer) para detectar uso de variáveis não inicializadas antes do deploy. Em linguagens gerenciadas como Java/C#, o compilador já força isso.

CVE-2025-0081HIGHIn dng_lossless_decoder::HuffDecode of dng_lossless_jpeg.cpp, there is a possible way to cause a crash due to uninitialized data. This couldEPSS 0.4%CVE-2024-45615LOWLibopensc: pkcs15init: usage of uninitialized values in libopensc and pkcs15initEPSS 0.4%CVE-2025-59348MEDIUMDragonfly incorrectly handles a task structure’s usedTraffic fieldEPSS 0.4%CVE-2026-43055HIGHscsi: target: file: Use kzalloc_flex for aio_cmdEPSS 0.4%CVE-2024-45616LOWLibopensc: uninitialized values after incorrect check or usage of apdu response values in libopenscEPSS 0.4%CVE-2022-25737HIGHUse of Uninitialized Variable in MODEMEPSS 0.4%CVE-2026-10977MEDIUMUninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leakEPSS 0.4%CVE-2026-10994MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information froEPSS 0.4%CVE-2021-34953HIGHFoxit PDF Reader Annotation Use of Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.3%CVE-2026-17968MEDIUMUninitialized Use in WebXR in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive infoEPSS 0.3%CVE-2026-15770MEDIUMUninitialized Use in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to obtain potentially sensitive information from EPSS 0.3%CVE-2026-17707MEDIUMUninitialized Use in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer proEPSS 0.3%CVE-2026-14421MEDIUMUninitialized Use in Dawn in Google Chrome on ChromeOS prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive infoEPSS 0.3%CVE-2026-13943MEDIUMUninitialized Use in CSS in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive informEPSS 0.3%CVE-2026-100783MEDIUMUninitialized memory in the Audio/Video componentEPSS 0.3%CVE-2026-17946MEDIUMUninitialized Use in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to obtaEPSS 0.3%CVE-2026-17759MEDIUMUninitialized Use in Codecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information frEPSS 0.3%CVE-2026-14408MEDIUMUninitialized Use in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive information fromEPSS 0.3%CVE-2026-13923MEDIUMUninitialized Use in GPU in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive informEPSS 0.3%CVE-2026-14399MEDIUMUninitialized Use in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive information fromEPSS 0.3%