Falhas do tipo CWE-908

345 resultados

Uso de recurso não inicializado

Ocorre quando o código utiliza uma variável, buffer, objeto ou estrutura de dados sem ter atribuído um valor inicial válido. O recurso contém lixo de memória (garbage values), causando comportamentos imprevisíveis: corrupção de dados, travamentos, vazamento de informações sensíveis ou até execução de código arbitrário.

Exemplo

Um aplicativo aloca um buffer para armazenar uma senha, mas a função que deveria inicializá-lo com zeros não é chamada antes de copiar dados do usuário. Se fragmentos de memória anterior (chaves, tokens) ainda estiverem no buffer, podem vazar quando este é processado ou comparado.

Como mitigar

Inicialize sempre variáveis e estruturas no ponto de declaração ou imediatamente após alocação (use memset, calloc em C/C++, ou construtores em linguagens modernas). Ative avisos do compilador para detecção de variáveis não inicializadas (-Wall -Wuninitialized em GCC/Clang) e considere usar ferramentas estáticas (SAST) para varredura em todo o código.

CVE-2026-16384HIGHInformation disclosure due to uninitialized memory in the Graphics: WebGPU componentEPSS 0.3%CVE-2026-16385HIGHInformation disclosure due to uninitialized memory in the Graphics: WebGPU componentEPSS 0.3%CVE-2026-79040MEDIUMUninitialized resource in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to read memory outside the sanEPSS 0.3%CVE-2026-87555MEDIUMUninitialized resource in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to read memory outside the sanEPSS 0.3%CVE-2026-79269MEDIUMUninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy viEPSS 0.3%CVE-2026-84326HIGHUninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox EPSS 0.3%CVE-2022-2950HIGH Altair HyperView Player versions 2021.1.0.27 and prior are vulnerable to the use of uninitialized memory vulnerability during parsing of EPSS 0.3%CVE-2026-54604MEDIUMOpenSlide: openslide_read_region() returns uninitialized memory with libtiff 4.7.1EPSS 0.3%CVE-2026-69288MEDIUMWindows GDI+ Information Disclosure VulnerabilityEPSS 0.3%CVE-2026-69853MEDIUMWin32k Information Disclosure VulnerabilityEPSS 0.3%CVE-2022-49326MEDIUMrtl818x: Prevent using not initialized queuesEPSS 0.3%CVE-2022-0433—A NULL pointer dereference flaw was found in the Linux kernel's BPF subsystem in the way a user triggers the map_get_next_key function of thEPSS 0.3%CVE-2024-50273HIGHbtrfs: reinitialize delayed ref list after deleting it from the listEPSS 0.3%CVE-2026-7141MEDIUMvLLM KV Block kv_cache_interface.py has_mamba_layers uninitialized resourceEPSS 0.3%CVE-2026-78958LOWUninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process toEPSS 0.3%CVE-2022-2949HIGH Altair HyperView Player versions 2021.1.0.27 and prior are vulnerable to the use of uninitialized memory vulnerability during parsing of EPSS 0.3%CVE-2025-27810MEDIUMMbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory EPSS 0.3%CVE-2022-49374MEDIUMtipc: check attribute length for bearer nameEPSS 0.3%CVE-2026-48101MEDIUMGHSL-2026-117: 7-Zip UEFI Capsule uninitialized heap memory disclosureEPSS 0.3%CVE-2026-58051HIGHlibssh2 - Free of Uninitialized Pointer in publickey List CleanupEPSS 0.3%