Falhas do tipo CWE-665

166 resultados

Inicialização inadequada de recursos

O software falha em inicializar corretamente um recurso (memória, arquivo, conexão, variável) ou não o inicializa antes de usá-lo, deixando-o em estado indefinido. Isso pode levar a comportamentos imprevisíveis, leitura de dados lixo, corrupção de estado ou exploração de segurança quando o recurso é acessado ou manipulado.

Exemplo

Um buffer alocado dinamicamente que nunca é zerado antes de usar em operações criptográficas, permitindo que dados sensíveis anteriormente armazenados naquele espaço de memória vaze. Ou uma estrutura de configuração que não inicializa seus campos, deixando ponteiros inválidos que podem ser dereferenciados.

Como mitigar

Sempre inicialize explicitamente todo recurso no momento da criação ou alocação (memset, construtores, atribuições de valor padrão). Use ferramentas estáticas (lint, compilador com warnings, SAST) para detectar variáveis não inicializadas e valide estados esperados antes de usar qualquer recurso.

CVE-2023-27325HIGHParallels Desktop Updater Improper Initialization Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2023-26084LOWThe armv8_dec_aes_gcm_full() API of Arm AArch64cryptolib before 86065c6 fails to the verify the authentication tag of AES-GCM protected dataEPSS 0.4%CVE-2026-94370MEDIUMMemory corruption (double free / use-after-free) vulnerability in core string handling impacts Qt for MCUsEPSS 0.3%CVE-2026-78940MEDIUMImproper initialization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a craftEPSS 0.3%CVE-2021-0145MEDIUMImproper initialization of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information diEPSS 0.3%CVE-2025-5702MEDIUMThe strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to EPSS 0.3%CVE-2026-103394LOWSession Smart Router: An incomplete operator causes the use of incorrect encryption keys during security policy updates.EPSS 0.3%CVE-2025-71128HIGHerspan: Initialize options_len before referencing options.EPSS 0.3%CVE-2023-27115—WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::cat_compute_size.EPSS 0.3%CVE-2021-4218—A flaw was found in the Linux kernel’s implementation of reading the SVC RDMA counters. Reading the counter sysctl panics the system. This fEPSS 0.3%CVE-2021-0125MEDIUMImproper initialization in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privileEPSS 0.3%CVE-2023-25010HIGHA malicious actor may convince a victim to open a malicious USD file that may trigger an uninitialized variable which may result in code exeEPSS 0.3%CVE-2023-20591MEDIUMImproper re-initialization of IOMMU during the DRTM event may permit an untrusted platform configuration to persist, allowing an attacker toEPSS 0.3%CVE-2021-0119MEDIUMImproper initialization in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privileEPSS 0.3%CVE-2022-2472HIGHImproper Initialization vulnerability in local server authentication logicEPSS 0.3%CVE-2022-32579MEDIUMImproper initialization in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially eEPSS 0.3%CVE-2024-45289HIGHUnbounded allocation in ctl(4) CAM Target LayerEPSS 0.3%CVE-2021-23223HIGHImproper initialization for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enablEPSS 0.3%CVE-2025-5745MEDIUMThe strncmp implementation optimized for the Power10 processor in the GNU C Library version 2.40 and later writes to vector registers v20 toEPSS 0.3%CVE-2025-46553LOW@misskey-dev/summaly Redirect Filter BypassEPSS 0.3%