Falhas do tipo CWE-665

166 resultados

Inicialização inadequada de recursos

O software falha em inicializar corretamente um recurso (memória, arquivo, conexão, variável) ou não o inicializa antes de usá-lo, deixando-o em estado indefinido. Isso pode levar a comportamentos imprevisíveis, leitura de dados lixo, corrupção de estado ou exploração de segurança quando o recurso é acessado ou manipulado.

Exemplo

Um buffer alocado dinamicamente que nunca é zerado antes de usar em operações criptográficas, permitindo que dados sensíveis anteriormente armazenados naquele espaço de memória vaze. Ou uma estrutura de configuração que não inicializa seus campos, deixando ponteiros inválidos que podem ser dereferenciados.

Como mitigar

Sempre inicialize explicitamente todo recurso no momento da criação ou alocação (memset, construtores, atribuições de valor padrão). Use ferramentas estáticas (lint, compilador com warnings, SAST) para detectar variáveis não inicializadas e valide estados esperados antes de usar qualquer recurso.

CVE-2026-54279LOWAIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar PersistenceEPSS 0.5%CVE-2024-36455CRITICALSymantec Privileged Access Manager Remote Command Execution vulnerabilityEPSS 0.5%CVE-2022-48352HIGHSome smartphones have data initialization issues. Successful exploitation of this vulnerability may cause a system panic.EPSS 0.5%CVE-2026-64035CRITICALigc: set tx buffer type for SMD framesEPSS 0.4%CVE-2026-87616HIGHImproper initialization in Views in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renEPSS 0.4%CVE-2024-54129CRITICALImproper Initialization of `imc` Scheme Leading to `SIGABRT` in ION-DTN BPv7EPSS 0.4%CVE-2026-54409HIGHA malicious actor with access to the network and under certain conditions could exploit an Improper Initialization vulnerability found in UnEPSS 0.4%CVE-2026-64368HIGHmm/slab: do not limit zeroing to orig_size when only red zoning is enabledEPSS 0.4%CVE-2026-26958LOWfilippo.io/edwards25519 MultiScalarMult function produces invalid results or undefined behavior if receiver is not the identityEPSS 0.4%CVE-2026-57229MEDIUMSuricata smtp/mime: incomplete state reset allows detection bypassEPSS 0.4%CVE-2023-28720MEDIUMImproper initialization for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenEPSS 0.4%CVE-2023-1047MEDIUMTechPowerUp RealTemp WinRing0x64.sys initializationEPSS 0.4%CVE-2023-35061LOWImproper initialization for the Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthentEPSS 0.4%CVE-2020-14347MEDIUMA flaw was found in the way xserver memory was not properly initialized. This could leak parts of server memory to the X client. In cases whEPSS 0.4%CVE-2021-20317—A flaw was found in the Linux kernel. A corrupted timer tree caused the task wakeup to be missing in the timerqueue_add function in lib/timeEPSS 0.4%CVE-2018-1118LOWLinux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating syEPSS 0.4%CVE-2023-27322HIGHParallels Desktop Service Improper Initialization Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2023-27324HIGHParallels Desktop Updater Improper Initialization Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2025-55118HIGHBMC Control-M/Agent memory corruption in SSL/TLS communicationEPSS 0.4%CVE-2023-40261MEDIUMDiebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR17, 4.0.0 SR07, 4.1.0 SR04, 4.2.0 SR04, and 4.3.0 SR02 fails to validate file atEPSS 0.4%