Falhas do tipo CWE-824

227 resultados

Ponteiro não inicializado

Ocorre quando um código usa um ponteiro sem antes atribuir um endereço válido a ele, fazendo com que ele aponte para lixo de memória. Isso permite leitura ou escrita em áreas arbitrárias, causando crashes, vazamento de dados ou execução de código malicioso.

Exemplo

Um driver de kernel aloca uma estrutura dinamicamente, mas em certos caminhos de código pula a inicialização do campo ponteiro que deveria referenciar um buffer. Quando outra função desreferencia esse ponteiro, acessa memória inválida e pode causar privilege escalation.

Como mitigar

Sempre inicialize ponteiros no ponto de declaração (preferencialmente com NULL) ou logo após alocação. Use ferramentas de análise estática (scan de código) e inicializadores de memória em testes para detectar uso de ponteiros soltos antes de código chegar à produção.

CVE-2022-22236HIGHJunos OS: SRX Series and MX Series: When specific valid SIP packets are received the PFE will crashEPSS 0.7%CVE-2026-45736MEDIUMws: Uninitialized memory disclosureEPSS 0.7%CVE-2021-38409HIGHFuji Electric Tellus Lite V-Simulator uninitialized pointerEPSS 0.7%CVE-2022-21168LOWICSA-22-090-03 Fuji Electric Alpha5EPSS 0.7%CVE-2026-67281HIGHUnauthenticated file read in Mikrotik RouterOSEPSS 0.7%CVE-2026-2805CRITICALInvalid pointer in the DOM: Core & HTML componentEPSS 0.7%CVE-2025-32451HIGHA memory corruption vulnerability exists in Foxit Reader 2025.1.0.27937 due to the use of an uninitialized pointer. A specially crafted JavaEPSS 0.7%CVE-2022-40643HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interactionEPSS 0.6%CVE-2022-40646HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interactionEPSS 0.6%CVE-2022-40649HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interactionEPSS 0.6%CVE-2022-40642HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interactionEPSS 0.6%CVE-2022-40645HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interactionEPSS 0.6%CVE-2025-2173MEDIUMlibzvbi conv.c vbi_strndup_iconv_ucs2 uninitialized pointerEPSS 0.6%CVE-2026-16353CRITICALInvalid pointer in the DOM: Bindings (WebIDL) componentEPSS 0.6%CVE-2024-33608HIGHBIG-IP IPsec vulnerabilityEPSS 0.6%CVE-2022-34480HIGHWithin the <code>lg_init()</code> function, if several allocations succeed but then one fails, an uninitialized pointer would have been freeEPSS 0.6%CVE-2026-2785HIGHInvalid pointer in the JavaScript Engine componentEPSS 0.6%CVE-2022-43609HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of IronCAD. User interaction is required to eEPSS 0.5%CVE-2026-117917CRITICALInvalid pointer in the Graphics: WebRender componentEPSS 0.5%CVE-2022-38427HIGHAdobe Photoshop U3D File Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.5%