Falhas do tipo CWE-457

245 resultados

Uso de variável não inicializada

Quando o código usa uma variável antes de atribuir um valor válido a ela, o programa pode ler lixo de memória (valores aleatórios deixados por outras operações). Isso leva a comportamentos imprevisíveis, falhas, ou no pior caso, a exploração de segurança quando o atacante consegue controlar o que está naquela posição de memória.

Exemplo

Um buffer local declarado em C sem inicialização (char buf[256];) é usado logo depois em memcpy ou sprintf. Se o conteúdo anterior daquela pilha contiver dados sensíveis ou endereços, um vazamento de informação ou corrupção de fluxo de controle pode ocorrer.

Como mitigar

Inicialize sempre as variáveis na declaração (char buf[256] = {0}; ou int x = 0;). Use análise estática (linters, compiler warnings, ferramentas como clang-analyzer) para detectar uso de variáveis não inicializadas antes do deploy. Em linguagens gerenciadas como Java/C#, o compilador já força isso.

CVE-2026-13969MEDIUMUninitialized Use in UI in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer procesEPSS 0.3%CVE-2026-13030MEDIUMUninitialized Use in GPU in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to obtain potentially sensitive inforEPSS 0.3%CVE-2026-13971MEDIUMUninitialized Use in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtaEPSS 0.3%CVE-2026-13970MEDIUMUninitialized Use in Media in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtEPSS 0.3%CVE-2024-9717HIGHTrimble SketchUp Viewer SKP File Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.3%CVE-2025-2014HIGHAshlar-Vellum Cobalt VS File Parsing Use of Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.3%CVE-2026-14418MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to leak cross-origin data via a crafted HTML paEPSS 0.3%CVE-2026-9963HIGHUninitialized Use in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specifiEPSS 0.3%CVE-2026-6311HIGHUninitialized Use in Accessibility in Google Chrome on Windows prior to 147.0.7727.101 allowed a remote attacker who had compromised the renEPSS 0.3%CVE-2026-19212MEDIUMWonderTrader TraderATP Cash Trade Conversion WTSTradeDef.hpp uninitialized variableEPSS 0.3%CVE-2026-17968MEDIUMUninitialized Use in WebXR in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive infoEPSS 0.3%CVE-2026-9917MEDIUMUninitialized Use in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive infEPSS 0.3%CVE-2026-17946MEDIUMUninitialized Use in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to obtaEPSS 0.3%CVE-2026-76919MEDIUMUse of Uninitialized Variable in WiresharkEPSS 0.3%CVE-2024-1848HIGHMultiple vulnerabilities exist in file reading procedure in SOLIDWORKS Desktop on Release SOLIDWORKS 2024EPSS 0.3%CVE-2026-17992MEDIUMUninitialized Use in Skia in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive inforEPSS 0.3%CVE-2026-5888MEDIUMUninitialized Use in WebCodecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive informationEPSS 0.3%CVE-2026-55990MEDIUMPacket of death for a DNSCrypt misconfigured UnboundEPSS 0.3%CVE-2026-92052HIGHPrivilege escalation due to uninitialized memory in the Graphics: CanvasWebGL componentEPSS 0.3%CVE-2026-11087MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leaEPSS 0.3%