Falhas do tipo CWE-824

208 resultados

Ponteiro não inicializado

Ocorre quando um código usa um ponteiro sem antes atribuir um endereço válido a ele, fazendo com que ele aponte para lixo de memória. Isso permite leitura ou escrita em áreas arbitrárias, causando crashes, vazamento de dados ou execução de código malicioso.

Exemplo

Um driver de kernel aloca uma estrutura dinamicamente, mas em certos caminhos de código pula a inicialização do campo ponteiro que deveria referenciar um buffer. Quando outra função desreferencia esse ponteiro, acessa memória inválida e pode causar privilege escalation.

Como mitigar

Sempre inicialize ponteiros no ponto de declaração (preferencialmente com NULL) ou logo após alocação. Use ferramentas de análise estática (scan de código) e inicializadores de memória em testes para detectar uso de ponteiros soltos antes de código chegar à produção.

CVE-2022-39146—A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), EPSS 0.3%CVE-2025-54207HIGHInDesign Desktop | Access of Uninitialized Pointer (CWE-824)EPSS 0.3%CVE-2021-41201HIGHUnitialized access in `EinsumHelper::ParseEquation`EPSS 0.2%CVE-2023-27858HIGHRockwell Automation Arena® Simulation Uninitialized Pointer VulnerabilityEPSS 0.2%CVE-2022-3377HIGHHorner Automation's Cscape version 9.90 SP 6 and prior does not properly validate user-supplied data. If a user opens a maliciously formed FEPSS 0.2%CVE-2022-3378HIGH Horner Automation's Cscape version 9.90 SP 7 and prior does not properly validate user-supplied data. If a user opens a maliciously formed EPSS 0.2%CVE-2026-21276HIGHInDesign Desktop | Access of Uninitialized Pointer (CWE-824)EPSS 0.2%CVE-2026-21275HIGHInDesign Desktop | Access of Uninitialized Pointer (CWE-824)EPSS 0.2%CVE-2025-2530HIGHLuxion KeyShot DAE File Parsing Access of Uninitialized Pointer Remote Code Execution VulnerabilityEPSS 0.2%CVE-2022-31599HIGHNVIDIA DGX A100 contains a vulnerability in SBIOS in the Ofbd, where a local user with elevated privileges can cause access to an uninitialiEPSS 0.2%CVE-2022-41851HIGHA vulnerability has been identified in JTTK (All versions < V11.1.1.0), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap EPSS 0.2%CVE-2022-2952HIGHGE CIMPLICITY Access of Uninitialized PointerEPSS 0.2%CVE-2022-3084HIGHGE CIMPLICITY Access of Uninitialized PointerEPSS 0.2%CVE-2023-31244HIGH The affected product does not properly validate user-supplied data. If a user opens a maliciously formed CSP file, then aEPSS 0.2%CVE-2022-21156MEDIUMAccess of uninitialized pointer in the Intel(R) Trace Analyzer and Collector before version 2021.5 may allow an authenticated user to potentEPSS 0.2%CVE-2023-24978HIGHA vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application is vulnerable to unEPSS 0.2%CVE-2023-25007HIGHA malicious actor may convince a user to open a malicious USD file that may trigger an uninitialized pointer which could result in code execEPSS 0.2%CVE-2025-9274HIGHOxford Instruments Imaris Viewer IMS File Parsing Uninitialized Pointer Remote Code Execution VulnerabilityEPSS 0.2%CVE-2025-49529HIGHIllustrator | Access of Uninitialized Pointer (CWE-824)EPSS 0.2%CVE-2025-43592HIGHInDesign Desktop | Access of Uninitialized Pointer (CWE-824)EPSS 0.2%