Falhas do tipo CWE-908

345 resultados

Uso de recurso não inicializado

Ocorre quando o código utiliza uma variável, buffer, objeto ou estrutura de dados sem ter atribuído um valor inicial válido. O recurso contém lixo de memória (garbage values), causando comportamentos imprevisíveis: corrupção de dados, travamentos, vazamento de informações sensíveis ou até execução de código arbitrário.

Exemplo

Um aplicativo aloca um buffer para armazenar uma senha, mas a função que deveria inicializá-lo com zeros não é chamada antes de copiar dados do usuário. Se fragmentos de memória anterior (chaves, tokens) ainda estiverem no buffer, podem vazar quando este é processado ou comparado.

Como mitigar

Inicialize sempre variáveis e estruturas no ponto de declaração ou imediatamente após alocação (use memset, calloc em C/C++, ou construtores em linguagens modernas). Ative avisos do compilador para detecção de variáveis não inicializadas (-Wall -Wuninitialized em GCC/Clang) e considere usar ferramentas estáticas (SAST) para varredura em todo o código.

CVE-2025-39904MEDIUMarm64: kexec: initialize kexec_buf struct in load_other_segments()EPSS 0.1%CVE-2026-70629MEDIUMFFmpeg 3.0 < 9.0 Uninitialized Heap Memory Read in RSCC DecoderEPSS 0.1%CVE-2026-70630MEDIUMFFmpeg 3.0 < 9.0 Uninitialized Heap Memory Read in Screenpresso DecoderEPSS 0.1%CVE-2026-63381MEDIUMLibevent: Dangling Pointer in `evbuffer_add_buffer_reference`EPSS 0.1%CVE-2026-47272HIGHpam_usb: OTP pad authentication bypass via missing system pad check and uninitialized RNG bufferEPSS 0.1%CVE-2026-49425MEDIUMKernel stack disclosure in 32-bit compatibility supportEPSS 0.1%CVE-2026-49424MEDIUMKernel stack disclosure in Linux compatibility layerEPSS 0.1%CVE-2024-36503HIGHMemory management vulnerability in the Gralloc module Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.1%CVE-2026-58084MEDIUMKernel stack disclosure via timer_settime(2)EPSS 0.1%CVE-2026-6368LOWwordexp with WRDE_APPEND can return or use invalid memoryEPSS 0.1%CVE-2025-12474LOWlibjxl: Uninitialized memory read in decoder due to incorrect optimization in patch handlingEPSS 0.1%CVE-2026-49423LOWRemote DOS via uninitialized memory access in KTLS receiveEPSS 0.1%CVE-2026-15710MEDIUMNetskope Client Endpoint DLP Kernel Driver Information LeakageEPSS 0.1%CVE-2025-48513MEDIUMUse of uninitialized resource within the AMD Platform Management Framework (PMF) could allow an attacker to read a uninitialized kernel memoEPSS 0.1%CVE-2026-68744LOWSssd: sssd: nss responder uninitialized heap disclosure in initgroups replyEPSS 0.1%CVE-2018-9377HIGHIn getIntentForIntentSender of ActivityManagerService.java, there is a possible way to access user metadata due to a pending intent. This coEPSS 0.1%CVE-2018-9378MEDIUMIn BnAudioPolicyService::onTransact of IAudioPolicyService.cpp, there is a possible information disclosure due to uninitialized data. This cEPSS 0.1%CVE-2018-9346MEDIUMIn BnAudioPolicyService::onTransact of AudioPolicyService.cpp, there is a possible information disclosure due to uninitialized data. This coEPSS 0.1%CVE-2018-9345MEDIUMIn BnAudioPolicyService::onTransact of AudioPolicyService.cpp, there is a possible information disclosure due to uninitialized data. This coEPSS 0.1%CVE-2024-29780MEDIUMIn hwbcc_ns_deprivilege of trusty/user/base/lib/hwbcc/client/hwbcc.c, there is a possible uninitialized stack data disclosure due to uninitiEPSS 0.1%