Falhas do tipo CWE-824

208 resultados

Ponteiro não inicializado

Ocorre quando um código usa um ponteiro sem antes atribuir um endereço válido a ele, fazendo com que ele aponte para lixo de memória. Isso permite leitura ou escrita em áreas arbitrárias, causando crashes, vazamento de dados ou execução de código malicioso.

Exemplo

Um driver de kernel aloca uma estrutura dinamicamente, mas em certos caminhos de código pula a inicialização do campo ponteiro que deveria referenciar um buffer. Quando outra função desreferencia esse ponteiro, acessa memória inválida e pode causar privilege escalation.

Como mitigar

Sempre inicialize ponteiros no ponto de declaração (preferencialmente com NULL) ou logo após alocação. Use ferramentas de análise estática (scan de código) e inicializadores de memória em testes para detectar uso de ponteiros soltos antes de código chegar à produção.

CVE-2023-24563HIGHA vulnerability has been identified in Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2023 (All versions < V223.0Update2). The EPSS 0.2%CVE-2021-41214HIGHReference binding to `nullptr` in `tf.ragged.cross`EPSS 0.2%CVE-2023-24562HIGHA vulnerability has been identified in Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2023 (All versions < V223.0Update2). The EPSS 0.2%CVE-2023-24561HIGHA vulnerability has been identified in Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2023 (All versions < V223.0Update2). The EPSS 0.2%CVE-2025-14739MEDIUMUninitialized Pointer Vulnerability in TP-Link WR940N and WR941NDEPSS 0.2%CVE-2024-50088HIGHbtrfs: fix uninitialized pointer free in add_inode_ref()EPSS 0.2%CVE-2024-50087HIGHbtrfs: fix uninitialized pointer free on read_alloc_one_name() errorEPSS 0.2%CVE-2026-54920NONEOpenEXR: Integer overflow and uninitialized pointer cause invalid delete in OpenEXRUtil image resizeEPSS 0.2%CVE-2021-41219HIGHUndefined behavior via `nullptr` reference binding in sparse matrix multiplicationEPSS 0.2%CVE-2024-8645MEDIUMAccess of Uninitialized Pointer in WiresharkEPSS 0.2%CVE-2023-49132HIGHA vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to uninitEPSS 0.2%CVE-2023-49131HIGHA vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to uninitEPSS 0.2%CVE-2023-49130HIGHA vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to uninitEPSS 0.2%CVE-2023-22366HIGHCX-Motion-MCH v2.32 and earlier contains an access of uninitialized pointer vulnerability. Having a user to open a specially crafted projectEPSS 0.2%CVE-2021-29568LOWReference binding to null in `ParameterizedTruncatedNormal`EPSS 0.2%CVE-2024-57943HIGHexfat: fix the new buffer was not zeroed before writingEPSS 0.2%CVE-2021-37662HIGHReference binding to nullptr in boosted trees in TensorFlowEPSS 0.2%CVE-2025-47121HIGHAdobe Framemaker | Access of Uninitialized Pointer (CWE-824)EPSS 0.2%CVE-2025-47098HIGHInCopy | Access of Uninitialized Pointer (CWE-824)EPSS 0.2%CVE-2023-20594—Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access.EPSS 0.2%