Falhas do tipo CWE-665

153 resultados

Inicialização inadequada de recursos

O software falha em inicializar corretamente um recurso (memória, arquivo, conexão, variável) ou não o inicializa antes de usá-lo, deixando-o em estado indefinido. Isso pode levar a comportamentos imprevisíveis, leitura de dados lixo, corrupção de estado ou exploração de segurança quando o recurso é acessado ou manipulado.

Exemplo

Um buffer alocado dinamicamente que nunca é zerado antes de usar em operações criptográficas, permitindo que dados sensíveis anteriormente armazenados naquele espaço de memória vaze. Ou uma estrutura de configuração que não inicializa seus campos, deixando ponteiros inválidos que podem ser dereferenciados.

Como mitigar

Sempre inicialize explicitamente todo recurso no momento da criação ou alocação (memset, construtores, atribuições de valor padrão). Use ferramentas estáticas (lint, compilador com warnings, SAST) para detectar variáveis não inicializadas e valide estados esperados antes de usar qualquer recurso.

CVE-2025-5702MEDIUMThe strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to EPSS 0.3%CVE-2021-4218—A flaw was found in the Linux kernel’s implementation of reading the SVC RDMA counters. Reading the counter sysctl panics the system. This fEPSS 0.3%CVE-2023-20591MEDIUMImproper re-initialization of IOMMU during the DRTM event may permit an untrusted platform configuration to persist, allowing an attacker toEPSS 0.3%CVE-2023-25010HIGHA malicious actor may convince a victim to open a malicious USD file that may trigger an uninitialized variable which may result in code exeEPSS 0.3%CVE-2021-0125MEDIUMImproper initialization in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privileEPSS 0.3%CVE-2021-0119MEDIUMImproper initialization in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privileEPSS 0.3%CVE-2022-2472HIGHImproper Initialization vulnerability in local server authentication logicEPSS 0.3%CVE-2022-32579MEDIUMImproper initialization in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially eEPSS 0.3%CVE-2026-54279LOWAIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar PersistenceEPSS 0.3%CVE-2024-45289HIGHUnbounded allocation in ctl(4) CAM Target LayerEPSS 0.3%CVE-2021-23223HIGHImproper initialization for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enablEPSS 0.3%CVE-2021-26326—Failure to validate VM_HSAVE_PA during SNP_INIT may result in a loss of memory integrity.EPSS 0.3%CVE-2025-5745MEDIUMThe strncmp implementation optimized for the Power10 processor in the GNU C Library version 2.40 and later writes to vector registers v20 toEPSS 0.3%CVE-2026-62433HIGHcorrect buffer checks for DM_OP hypercallsEPSS 0.3%CVE-2025-2149LOWPyTorch Quantized Sigmoid Module nnq_Sigmoid initializationEPSS 0.3%CVE-2025-46553LOW@misskey-dev/summaly Redirect Filter BypassEPSS 0.2%CVE-2022-32823MEDIUMA memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11EPSS 0.2%CVE-2021-26312—Failure to flush the Translation Lookaside Buffer (TLB) of the I/O memory management unit (IOMMU) may lead an IO device to write to memory iEPSS 0.2%CVE-2021-33636HIGHLoad malicious images may cause process to be hijackedEPSS 0.2%CVE-2021-29613MEDIUMIncomplete validation in `tf.raw_ops.CTCLoss`EPSS 0.2%