Falhas do tipo CWE-824

208 resultados

Ponteiro não inicializado

Ocorre quando um código usa um ponteiro sem antes atribuir um endereço válido a ele, fazendo com que ele aponte para lixo de memória. Isso permite leitura ou escrita em áreas arbitrárias, causando crashes, vazamento de dados ou execução de código malicioso.

Exemplo

Um driver de kernel aloca uma estrutura dinamicamente, mas em certos caminhos de código pula a inicialização do campo ponteiro que deveria referenciar um buffer. Quando outra função desreferencia esse ponteiro, acessa memória inválida e pode causar privilege escalation.

Como mitigar

Sempre inicialize ponteiros no ponto de declaração (preferencialmente com NULL) ou logo após alocação. Use ferramentas de análise estática (scan de código) e inicializadores de memória em testes para detectar uso de ponteiros soltos antes de código chegar à produção.

CVE-2021-41538—A vulnerability has been identified in NX 1953 Series (All versions < V1973.3700), NX 1980 Series (All versions < V1988), Solid Edge SE2021 EPSS 1.0%CVE-2021-42702LOWInkscape Access of Uninitialized PointerEPSS 1.0%CVE-2022-22198HIGHJunos OS: MX MS-MPC or MS-MIC, or SRX SPC crashes if it receives a SIP message with a specific contact header formatEPSS 0.9%CVE-2020-8110MEDIUMBitdefender ceva_emu.cvd module denial-of-service (VA-8766)EPSS 0.9%CVE-2022-1809HIGHAccess of Uninitialized Pointer in radareorg/radare2EPSS 0.9%CVE-2023-30847HIGHH2O vulnerable to read from uninitialized pointer in the reverse proxy handlerEPSS 0.9%CVE-2023-29178MEDIUMA access of uninitialized pointer vulnerability [CWE-824] in Fortinet FortiProxy version 7.2.0 through 7.2.3 and before 7.0.9 and FortiOS vEPSS 0.9%CVE-2021-29095MEDIUMArcGIS Server image service and raster analytics security update: uninitialized pointerEPSS 0.9%CVE-2022-38138HIGHThe Triangle Microworks IEC 61850 Library (Any client or server using the C language library with a version number of 11.2.0 or earlier and EPSS 0.9%CVE-2021-34596MEDIUMCODESYS V2 runtime: Access of Uninitialized Pointer may result in denial-of-serviceEPSS 0.9%CVE-2023-24826MEDIUMUsage of Uninitialized Timer during forwarding of Fragments with SFREPSS 0.8%CVE-2022-46280CRITICALA use of uninitialized pointer vulnerability exists in the PQS format pFormat functionality of Open Babel 3.1.1 and master commit 530dbfa3. EPSS 0.8%CVE-2022-45861MEDIUMAn access of uninitialized pointer vulnerability [CWE-824] in the SSL VPN portal of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.EPSS 0.8%CVE-2022-44451CRITICALA use of uninitialized pointer vulnerability exists in the MSI format atom functionality of Open Babel 3.1.1 and master commit 530dbfa3. A sEPSS 0.8%CVE-2022-42885CRITICALA use of uninitialized pointer vulnerability exists in the GRO format res functionality of Open Babel 3.1.1 and master commit 530dbfa3. A spEPSS 0.8%CVE-2022-29033—A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), TeamcentEPSS 0.8%CVE-2026-42959HIGHCrash during DNSSEC validation of malicious contentEPSS 0.8%CVE-2022-23636MEDIUMInvalid drop of partially-initialized instances in wasmtimeEPSS 0.8%CVE-2026-45736MEDIUMws: Uninitialized memory disclosureEPSS 0.7%CVE-2022-21168LOWICSA-22-090-03 Fuji Electric Alpha5EPSS 0.7%