Falhas do tipo CWE-457

245 resultados

Uso de variável não inicializada

Quando o código usa uma variável antes de atribuir um valor válido a ela, o programa pode ler lixo de memória (valores aleatórios deixados por outras operações). Isso leva a comportamentos imprevisíveis, falhas, ou no pior caso, a exploração de segurança quando o atacante consegue controlar o que está naquela posição de memória.

Exemplo

Um buffer local declarado em C sem inicialização (char buf[256];) é usado logo depois em memcpy ou sprintf. Se o conteúdo anterior daquela pilha contiver dados sensíveis ou endereços, um vazamento de informação ou corrupção de fluxo de controle pode ocorrer.

Como mitigar

Inicialize sempre as variáveis na declaração (char buf[256] = {0}; ou int x = 0;). Use análise estática (linters, compiler warnings, ferramentas como clang-analyzer) para detectar uso de variáveis não inicializadas antes do deploy. Em linguagens gerenciadas como Java/C#, o compilador já força isso.

CVE-2021-34951LOWFoxit PDF Reader Annotation Use of Uninitialized Variable Information Disclosure VulnerabilityEPSS 0.3%CVE-2026-19161LOWUninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leaEPSS 0.3%CVE-2024-23159HIGHMultiple ZDI Vulnerabilities in Autodesk AutoCAD and certain AutoCAD-based productsEPSS 0.3%CVE-2024-45618LOWLibopensc: uninitialized values after incorrect or missing checking return values of functions in pkcs15initEPSS 0.3%CVE-2026-13950MEDIUMUninitialized Use in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtaiEPSS 0.3%CVE-2026-13947MEDIUMUninitialized Use in XR in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtainEPSS 0.3%CVE-2026-13833MEDIUMUninitialized Use in ANGLE in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted EPSS 0.3%CVE-2026-6751HIGHUninitialized memory in the Audio/Video: Web Codecs componentEPSS 0.3%CVE-2024-45617LOWLibopensc: uninitialized values after incorrect or missing checking return values of functions in libopenscEPSS 0.3%CVE-2025-2287HIGHLocal Code Execution Vulnerability in Arena®EPSS 0.3%CVE-2025-2286HIGHLocal Code Execution Vulnerability in Arena®EPSS 0.3%CVE-2025-2285HIGHLocal Code Execution Vulnerability in Arena®EPSS 0.3%CVE-2026-84564MEDIUMAn uninitialized memory issue was addressed with improved memory initialization. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 andEPSS 0.3%CVE-2024-9355MEDIUMGolang-fips: golang fips zeroed bufferEPSS 0.3%CVE-2024-7541LOWoFono AT CMT Command Uninitialized Variable Information Disclosure VulnerabilityEPSS 0.3%CVE-2024-7542LOWoFono AT CMGR Command Uninitialized Variable Information Disclosure VulnerabilityEPSS 0.3%CVE-2024-7540LOWoFono AT CMGL Command Uninitialized Variable Information Disclosure VulnerabilityEPSS 0.3%CVE-2024-31874MEDIUMIBM Security Verify Access Appliance denial of serviceEPSS 0.3%CVE-2026-10960HIGHUninitialized Use in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to poEPSS 0.3%CVE-2026-13023MEDIUMUninitialized Use in GPU in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to obtaEPSS 0.3%