Falhas do tipo CWE-665

153 resultados

Inicialização inadequada de recursos

O software falha em inicializar corretamente um recurso (memória, arquivo, conexão, variável) ou não o inicializa antes de usá-lo, deixando-o em estado indefinido. Isso pode levar a comportamentos imprevisíveis, leitura de dados lixo, corrupção de estado ou exploração de segurança quando o recurso é acessado ou manipulado.

Exemplo

Um buffer alocado dinamicamente que nunca é zerado antes de usar em operações criptográficas, permitindo que dados sensíveis anteriormente armazenados naquele espaço de memória vaze. Ou uma estrutura de configuração que não inicializa seus campos, deixando ponteiros inválidos que podem ser dereferenciados.

Como mitigar

Sempre inicialize explicitamente todo recurso no momento da criação ou alocação (memset, construtores, atribuições de valor padrão). Use ferramentas estáticas (lint, compilador com warnings, SAST) para detectar variáveis não inicializadas e valide estados esperados antes de usar qualquer recurso.

CVE-2026-54409HIGHA malicious actor with access to the network and under certain conditions could exploit an Improper Initialization vulnerability found in UnEPSS 0.4%CVE-2026-57229MEDIUMSuricata smtp/mime: incomplete state reset allows detection bypassEPSS 0.4%CVE-2023-28720MEDIUMImproper initialization for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenEPSS 0.4%CVE-2021-20317—A flaw was found in the Linux kernel. A corrupted timer tree caused the task wakeup to be missing in the timerqueue_add function in lib/timeEPSS 0.4%CVE-2023-1047MEDIUMTechPowerUp RealTemp WinRing0x64.sys initializationEPSS 0.4%CVE-2023-35061LOWImproper initialization for the Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthentEPSS 0.4%CVE-2020-14347MEDIUMA flaw was found in the way xserver memory was not properly initialized. This could leak parts of server memory to the X client. In cases whEPSS 0.4%CVE-2026-87616HIGHImproper initialization in Views in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renEPSS 0.4%CVE-2018-1118LOWLinux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating syEPSS 0.4%CVE-2026-26958LOWfilippo.io/edwards25519 MultiScalarMult function produces invalid results or undefined behavior if receiver is not the identityEPSS 0.4%CVE-2026-78940MEDIUMImproper initialization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a craftEPSS 0.4%CVE-2023-27322HIGHParallels Desktop Service Improper Initialization Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2023-27324HIGHParallels Desktop Updater Improper Initialization Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2025-55118HIGHBMC Control-M/Agent memory corruption in SSL/TLS communicationEPSS 0.4%CVE-2023-40261MEDIUMDiebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR17, 4.0.0 SR07, 4.1.0 SR04, 4.2.0 SR04, and 4.3.0 SR02 fails to validate file atEPSS 0.4%CVE-2023-27325HIGHParallels Desktop Updater Improper Initialization Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2023-26084LOWThe armv8_dec_aes_gcm_full() API of Arm AArch64cryptolib before 86065c6 fails to the verify the authentication tag of AES-GCM protected dataEPSS 0.4%CVE-2021-0145MEDIUMImproper initialization of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information diEPSS 0.3%CVE-2023-27115—WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::cat_compute_size.EPSS 0.3%CVE-2026-12233MEDIUMUninitialized mutex in TLS trusted-credential backend causes kernel NULL-deref DoS under contentionEPSS 0.3%