Falhas do tipo CWE-824

227 resultados

Ponteiro não inicializado

Ocorre quando um código usa um ponteiro sem antes atribuir um endereço válido a ele, fazendo com que ele aponte para lixo de memória. Isso permite leitura ou escrita em áreas arbitrárias, causando crashes, vazamento de dados ou execução de código malicioso.

Exemplo

Um driver de kernel aloca uma estrutura dinamicamente, mas em certos caminhos de código pula a inicialização do campo ponteiro que deveria referenciar um buffer. Quando outra função desreferencia esse ponteiro, acessa memória inválida e pode causar privilege escalation.

Como mitigar

Sempre inicialize ponteiros no ponto de declaração (preferencialmente com NULL) ou logo após alocação. Use ferramentas de análise estática (scan de código) e inicializadores de memória em testes para detectar uso de ponteiros soltos antes de código chegar à produção.

CVE-2023-26387MEDIUMZDI-CAN-20265: Adobe Substance 3D Stager USDC File Parsing Uninitialized Variable Information Disclosure VulnerabilityEPSS 0.3%CVE-2023-29286MEDIUMZDI-CAN-20369: Adobe Substance 3D Painter USD File Parsing Uninitialized Variable Information Disclosure VulnerabilityEPSS 0.3%CVE-2025-27162HIGHAcrobat Reader | Access of Uninitialized Pointer (CWE-824)EPSS 0.3%CVE-2026-66081HIGHApache Thrift: c_glib read_message_begin leaves output parameters unset for non-versioned messagesEPSS 0.3%CVE-2026-115327MEDIUMlibyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC ParserEPSS 0.3%CVE-2024-24925HIGHA vulnerability has been identified in Simcenter Femap (All versions < V2306.0000). The affected application is vulnerable to uninitialized EPSS 0.3%CVE-2026-6751HIGHUninitialized memory in the Audio/Video: Web Codecs componentEPSS 0.3%CVE-2025-66588HIGHAccess of Uninitialized Pointer vulnerability in AzeoTech DAQFactoryEPSS 0.3%CVE-2025-43557HIGHAnimate | Access of Uninitialized Pointer (CWE-824)EPSS 0.3%CVE-2024-21919HIGHRockwell Automation Arena Simulation Vulnerable To Uninitialized PointerEPSS 0.3%CVE-2025-30326HIGHPhotoshop Desktop | Access of Uninitialized Pointer (CWE-824)EPSS 0.3%CVE-2025-54207HIGHInDesign Desktop | Access of Uninitialized Pointer (CWE-824)EPSS 0.3%CVE-2023-27858HIGHRockwell Automation Arena® Simulation Uninitialized Pointer VulnerabilityEPSS 0.3%CVE-2025-43592HIGHInDesign Desktop | Access of Uninitialized Pointer (CWE-824)EPSS 0.3%CVE-2025-49529HIGHIllustrator | Access of Uninitialized Pointer (CWE-824)EPSS 0.3%CVE-2026-39458HIGHBIG-IP DNS Cache vulnerabilityEPSS 0.3%CVE-2022-3378HIGH Horner Automation's Cscape version 9.90 SP 7 and prior does not properly validate user-supplied data. If a user opens a maliciously formed EPSS 0.3%CVE-2022-3377HIGHHorner Automation's Cscape version 9.90 SP 6 and prior does not properly validate user-supplied data. If a user opens a maliciously formed FEPSS 0.3%CVE-2022-41851HIGHA vulnerability has been identified in JTTK (All versions < V11.1.1.0), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap EPSS 0.3%CVE-2026-6778MEDIUMInvalid pointer in the Audio/Video: Playback componentEPSS 0.3%