Falhas do tipo CWE-457

283 resultados

Uso de variável não inicializada

Quando o código usa uma variável antes de atribuir um valor válido a ela, o programa pode ler lixo de memória (valores aleatórios deixados por outras operações). Isso leva a comportamentos imprevisíveis, falhas, ou no pior caso, a exploração de segurança quando o atacante consegue controlar o que está naquela posição de memória.

Exemplo

Um buffer local declarado em C sem inicialização (char buf[256];) é usado logo depois em memcpy ou sprintf. Se o conteúdo anterior daquela pilha contiver dados sensíveis ou endereços, um vazamento de informação ou corrupção de fluxo de controle pode ocorrer.

Como mitigar

Inicialize sempre as variáveis na declaração (char buf[256] = {0}; ou int x = 0;). Use análise estática (linters, compiler warnings, ferramentas como clang-analyzer) para detectar uso de variáveis não inicializadas antes do deploy. Em linguagens gerenciadas como Java/C#, o compilador já força isso.

CVE-2026-112898MEDIUMPillow: Image.quantize() with empty palette leaks uninitialized stack memoryEPSS 0.3%CVE-2024-1847HIGHMultiple vulnerabilities exist in file reading procedure in eDrawings from Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024EPSS 0.3%CVE-2026-19161LOWUninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leaEPSS 0.3%CVE-2026-10976MEDIUMUninitialized Use in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information fromEPSS 0.3%CVE-2026-13825HIGHUninitialized Use in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a craEPSS 0.3%CVE-2024-45617LOWLibopensc: uninitialized values after incorrect or missing checking return values of functions in libopenscEPSS 0.3%CVE-2026-84639CRITICALUninitialized memory in MIME parsingEPSS 0.3%CVE-2026-14010MEDIUMUninitialized Use in Codecs in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive infEPSS 0.3%CVE-2026-14088MEDIUMUninitialized Use in Canvas in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive infEPSS 0.3%CVE-2026-14070MEDIUMInteger overflow in WebNN in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information fromEPSS 0.3%CVE-2026-14008MEDIUMUninitialized Use in WebXR in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive infoEPSS 0.3%CVE-2026-14051MEDIUMUninitialized Use in GamepadAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process tEPSS 0.3%CVE-2026-13958MEDIUMUninitialized Use in Codecs in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive infEPSS 0.3%CVE-2021-34951LOWFoxit PDF Reader Annotation Use of Uninitialized Variable Information Disclosure VulnerabilityEPSS 0.3%CVE-2024-23159HIGHMultiple ZDI Vulnerabilities in Autodesk AutoCAD and certain AutoCAD-based productsEPSS 0.3%CVE-2026-66859HIGHApache Thrift: c_glib multiplexed processor crashes on a message it cannot routeEPSS 0.3%CVE-2026-76919MEDIUMUse of Uninitialized Variable in WiresharkEPSS 0.3%CVE-2024-45618LOWLibopensc: uninitialized values after incorrect or missing checking return values of functions in pkcs15initEPSS 0.3%CVE-2026-13947MEDIUMUninitialized Use in XR in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtainEPSS 0.3%CVE-2026-13950MEDIUMUninitialized Use in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtaiEPSS 0.3%