Falhas do tipo CWE-824

208 resultados

Ponteiro não inicializado

Ocorre quando um código usa um ponteiro sem antes atribuir um endereço válido a ele, fazendo com que ele aponte para lixo de memória. Isso permite leitura ou escrita em áreas arbitrárias, causando crashes, vazamento de dados ou execução de código malicioso.

Exemplo

Um driver de kernel aloca uma estrutura dinamicamente, mas em certos caminhos de código pula a inicialização do campo ponteiro que deveria referenciar um buffer. Quando outra função desreferencia esse ponteiro, acessa memória inválida e pode causar privilege escalation.

Como mitigar

Sempre inicialize ponteiros no ponto de declaração (preferencialmente com NULL) ou logo após alocação. Use ferramentas de análise estática (scan de código) e inicializadores de memória em testes para detectar uso de ponteiros soltos antes de código chegar à produção.

CVE-2026-2785HIGHInvalid pointer in the JavaScript Engine componentEPSS 0.4%CVE-2021-3608—A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue occurs while handling EPSS 0.4%CVE-2023-47054MEDIUMZDI-CAN-21782: Adobe Audition MP4 File Parsing Uninitialized Variable Information Disclosure VulnerabilityEPSS 0.4%CVE-2024-9258HIGHIrfanView SID File Parsing Uninitialized Pointer Remote Code Execution VulnerabilityEPSS 0.4%CVE-2023-47053MEDIUMZDI-CAN-21689: Adobe Audition MP4 File Parsing Uninitialized Variable Information Disclosure VulnerabilityEPSS 0.4%CVE-2024-46951HIGHAn issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. An unchecked Implementation pointer in Pattern color space coEPSS 0.4%CVE-2025-1761MEDIUMIBM Concert Software information disclosureEPSS 0.4%CVE-2023-26334HIGHZDI-CAN-20149: Adobe Dimension USD File Parsing Uninitialized Pointer Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-28691HIGHImageMagick has an uninitialized pointer dereference in JBIG decoderEPSS 0.4%CVE-2023-34288HIGHAshlar-Vellum Cobalt XE File Parsing Uninitialized Pointer Remote Code Execution VulnerabilityEPSS 0.3%CVE-2023-21618HIGHZDI-CAN-20963: Adobe Substance 3D Designer SBS File Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.3%CVE-2023-29278HIGHZDI-CAN-20371: Adobe Substance 3D Painter GLTF File Parsing Uninitialized Variable Information Disclosure VulnerabilityEPSS 0.3%CVE-2026-1200MEDIUMRemote code execution via segmentation fault in increasebufferto functionEPSS 0.3%CVE-2025-1047HIGHLuxion KeyShot PVS File Parsing Access of Uninitialized Pointer Remote Code Execution VulnerabilityEPSS 0.3%CVE-2023-47047MEDIUMZDI-CAN-21685: Adobe Audition MP4 File Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.3%CVE-2023-47060LOWZDI-CAN-21792: Adobe Premiere Pro MP4 File Uninitialized Variable Information Disclosure VulnerabilityEPSS 0.3%CVE-2023-26370HIGHZDI-CAN-21257: Adobe Photoshop PSD File Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.3%CVE-2023-26344MEDIUMZDI-CAN-19467: Adobe Dimension USD File Access of Uninitialized Pointer Information Disclosure VulnerabilityEPSS 0.3%CVE-2023-4508MEDIUMDenial of Service in GerbvEPSS 0.3%CVE-2025-43545HIGHBridge | Access of Uninitialized Pointer (CWE-824)EPSS 0.3%