Falhas do tipo CWE-824

220 resultados

Ponteiro não inicializado

Ocorre quando um código usa um ponteiro sem antes atribuir um endereço válido a ele, fazendo com que ele aponte para lixo de memória. Isso permite leitura ou escrita em áreas arbitrárias, causando crashes, vazamento de dados ou execução de código malicioso.

Exemplo

Um driver de kernel aloca uma estrutura dinamicamente, mas em certos caminhos de código pula a inicialização do campo ponteiro que deveria referenciar um buffer. Quando outra função desreferencia esse ponteiro, acessa memória inválida e pode causar privilege escalation.

Como mitigar

Sempre inicialize ponteiros no ponto de declaração (preferencialmente com NULL) ou logo após alocação. Use ferramentas de análise estática (scan de código) e inicializadores de memória em testes para detectar uso de ponteiros soltos antes de código chegar à produção.

CVE-2023-29278HIGHZDI-CAN-20371: Adobe Substance 3D Painter GLTF File Parsing Uninitialized Variable Information Disclosure VulnerabilityEPSS 0.3%CVE-2026-109774CRITICALInvalid pointer, undefined behavior in the DOM: Notifications componentEPSS 0.3%CVE-2025-1047HIGHLuxion KeyShot PVS File Parsing Access of Uninitialized Pointer Remote Code Execution VulnerabilityEPSS 0.3%CVE-2023-47047MEDIUMZDI-CAN-21685: Adobe Audition MP4 File Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.3%CVE-2025-43545HIGHBridge | Access of Uninitialized Pointer (CWE-824)EPSS 0.3%CVE-2023-47060LOWZDI-CAN-21792: Adobe Premiere Pro MP4 File Uninitialized Variable Information Disclosure VulnerabilityEPSS 0.3%CVE-2023-26344MEDIUMZDI-CAN-19467: Adobe Dimension USD File Access of Uninitialized Pointer Information Disclosure VulnerabilityEPSS 0.3%CVE-2023-4508MEDIUMDenial of Service in GerbvEPSS 0.3%CVE-2022-33280HIGHAccess of uninitialized pointer in Bluetooth HOSTEPSS 0.3%CVE-2021-3592—An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the bootp_input() functEPSS 0.3%CVE-2021-3595—An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the tftp_input() functiEPSS 0.3%CVE-2021-3594—An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp_input() functioEPSS 0.3%CVE-2021-3593—An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp6_input() functiEPSS 0.3%CVE-2023-29286MEDIUMZDI-CAN-20369: Adobe Substance 3D Painter USD File Parsing Uninitialized Variable Information Disclosure VulnerabilityEPSS 0.3%CVE-2023-26386MEDIUMZDI-CAN-20266: Adobe Substance 3D Stager USDC File Parsing Uninitialized Variable Information Disclosure VulnerabilityEPSS 0.3%CVE-2023-26387MEDIUMZDI-CAN-20265: Adobe Substance 3D Stager USDC File Parsing Uninitialized Variable Information Disclosure VulnerabilityEPSS 0.3%CVE-2025-27162HIGHAcrobat Reader | Access of Uninitialized Pointer (CWE-824)EPSS 0.3%CVE-2026-66081HIGHApache Thrift: c_glib read_message_begin leaves output parameters unset for non-versioned messagesEPSS 0.3%CVE-2026-115327MEDIUMlibyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC ParserEPSS 0.3%CVE-2024-24925HIGHA vulnerability has been identified in Simcenter Femap (All versions < V2306.0000). The affected application is vulnerable to uninitialized EPSS 0.3%