Falhas do tipo CWE-908

345 resultados

Uso de recurso não inicializado

Ocorre quando o código utiliza uma variável, buffer, objeto ou estrutura de dados sem ter atribuído um valor inicial válido. O recurso contém lixo de memória (garbage values), causando comportamentos imprevisíveis: corrupção de dados, travamentos, vazamento de informações sensíveis ou até execução de código arbitrário.

Exemplo

Um aplicativo aloca um buffer para armazenar uma senha, mas a função que deveria inicializá-lo com zeros não é chamada antes de copiar dados do usuário. Se fragmentos de memória anterior (chaves, tokens) ainda estiverem no buffer, podem vazar quando este é processado ou comparado.

Como mitigar

Inicialize sempre variáveis e estruturas no ponto de declaração ou imediatamente após alocação (use memset, calloc em C/C++, ou construtores em linguagens modernas). Ative avisos do compilador para detecção de variáveis não inicializadas (-Wall -Wuninitialized em GCC/Clang) e considere usar ferramentas estáticas (SAST) para varredura em todo o código.

CVE-2026-69672MEDIUMWindows DNS Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-69770MEDIUMWindows Spaceport.sys Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-26175MEDIUMWindows Boot Manager Security Feature Bypass VulnerabilityEPSS 0.4%CVE-2026-78965MEDIUMUninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted EPSS 0.4%CVE-2026-42969MEDIUMWindows Push Notification Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-72945MEDIUMWindows Task Scheduler Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-59137MEDIUMWindows Event Logging Service Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-62709MEDIUMWindows GDI+ Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-62740MEDIUMWindows Imaging Component Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-81391MEDIUMMicrosoft Excel Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-81958MEDIUMMicrosoft Excel Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-78977MEDIUMUninitialized resource in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to potentially read memory insEPSS 0.4%CVE-2025-27796MEDIUMReadWPGImage in WPG in GraphicsMagick before 1.3.46 mishandles palette buffer allocation, resulting in out-of-bounds access to heap memory iEPSS 0.4%CVE-2024-13164HIGHAn uninitialized resource in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a locaEPSS 0.4%CVE-2024-8654MEDIUMMongoDB Server may access non-initialized region of memory leading to unexpected behaviourEPSS 0.4%CVE-2026-59136MEDIUMMicrosoft COM for Windows Information Disclosure VulnerabilityEPSS 0.4%CVE-2024-3862MEDIUMThe MarkStack assignment operator, part of the JavaScript engine, could access uninitialized memory if it were used in a self-assignment. ThEPSS 0.4%CVE-2026-70317MEDIUMMicrosoft Office Information Disclosure VulnerabilityEPSS 0.4%CVE-2024-3299HIGHOut-Of-Bounds Write, Use of Uninitialized Resource and Use-After-Free vulnerabilities exist in the SLDDRW and SLDPRT file reading procedure in eDrawings from Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024EPSS 0.4%CVE-2025-59964HIGHJunos OS: SRX4700: When forwarding-options sampling is enabled any traffic destined to the RE will cause the forwarding line card to crash and restartEPSS 0.4%