Falhas do tipo CWE-824

227 resultados

Ponteiro não inicializado

Ocorre quando um código usa um ponteiro sem antes atribuir um endereço válido a ele, fazendo com que ele aponte para lixo de memória. Isso permite leitura ou escrita em áreas arbitrárias, causando crashes, vazamento de dados ou execução de código malicioso.

Exemplo

Um driver de kernel aloca uma estrutura dinamicamente, mas em certos caminhos de código pula a inicialização do campo ponteiro que deveria referenciar um buffer. Quando outra função desreferencia esse ponteiro, acessa memória inválida e pode causar privilege escalation.

Como mitigar

Sempre inicialize ponteiros no ponto de declaração (preferencialmente com NULL) ou logo após alocação. Use ferramentas de análise estática (scan de código) e inicializadores de memória em testes para detectar uso de ponteiros soltos antes de código chegar à produção.

CVE-2026-3497LOWVulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by vaEPSS 2.3%CVE-2020-27778—A flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote attacker could exploit this flaw by providing a EPSS 2.2%CVE-2023-44365HIGHZDI-CAN-21931: Adobe Acrobat Reader DC Font Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 2.0%CVE-2021-29098HIGHArcGIS general raster security update: uninitialized pointerEPSS 2.0%CVE-2021-32931—An uninitialized pointer in FATEK Automation FvDesigner, Versions 1.5.88 and prior may be exploited while the application is processing projEPSS 2.0%CVE-2021-22639—An uninitialized pointer issue has been identified in the way the application processes project files, allowing an attacker to craft a speciEPSS 1.9%CVE-2020-16203—Delta Industrial Automation CNCSoft ScreenEditor, Versions 1.01.23 and prior. An uninitialized pointer may be exploited by processing a specEPSS 1.9%CVE-2021-43746MEDIUMAdobe Premiere Rush MP4 File Parsing Uninitialized Variable Information Disclosure VulnerabilityEPSS 1.8%CVE-2021-1619CRITICALCisco IOS XE Software NETCONF and RESTCONF Authentication Bypass VulnerabilityEPSS 1.8%CVE-2021-33542HIGHPhoenix Contact: Automation Worx Software Suite affected by Remote Code Execution (RCE) vulnerabilityEPSS 1.8%CVE-2021-31479HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User inEPSS 1.4%CVE-2018-5392—mingw-w64 version 5.0.4 by default produces executables that opt in to ASLR, but are not compatible with ASLREPSS 1.4%CVE-2021-31503HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.3.84 (pEPSS 1.4%CVE-2021-37180—A vulnerability has been identified in Solid Edge SE2021 (All Versions < SE2021MP7). The PSKERNEL.dll library lacks proper validation while EPSS 1.4%CVE-2021-43030LOWAdobe Premiere Rush MP4 File Parsing Uninitialized Variable Information Disclosure VulnerabilityEPSS 1.4%CVE-2026-2100MEDIUMP11-kit: null dereference via c_derivekey with specific null parametersEPSS 1.3%CVE-2021-22758—A CWE-824: Access of uninitialized pointer vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in losEPSS 1.2%CVE-2018-19018—An access of uninitialized pointer vulnerability in CX-Supervisor (Versions 3.42 and prior) could lead to type confusion when processing proEPSS 1.2%CVE-2021-22670—An uninitialized pointer may be exploited in Fatek FvDesigner Version 1.5.76 and prior while the application is processing project files, alEPSS 1.1%CVE-2022-32136MEDIUMCodesys runtime systems: Access of uninitialised pointer lead to denial of service.EPSS 1.0%