Weaknesses of type CWE-824

205 results

Ponteiro não inicializado

Ocorre quando um ponteiro é usado sem ter recebido um endereço de memória válido antes. O código tenta acessar ou modificar dados através de um ponteiro que aponta para uma posição arbitrária ou lixo de memória, causando comportamento impredizível, corrupção de dados ou crash.

Example

Uma função aloca memória para uma estrutura, mas em um caminho de execução esquece de inicializar um ponteiro dentro dela. Quando outra parte do código tenta usar esse ponteiro, ele aponta para lixo de memória, causando leitura ou escrita em endereços inválidos.

How to mitigate

Sempre inicialize ponteiros explicitamente no ponto de declaração (com NULL ou um endereço válido) e valide antes de usar. Use ferramentas de análise estática (Clang Static Analyzer, Valgrind) e, em linguagens modernas, prefira gerenciamento automático de memória ou smart pointers ao invés de ponteiros brutos.

CVE-2018-9948—This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User iEPSS 63.7%CVE-2022-21971HIGHWindows Runtime Remote Code Execution VulnerabilityEPSS 53.9%KEVCVE-2015-1770HIGHMicrosoft Office 2013 SP1 and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft OfEPSS 35.1%KEVCVE-2022-27794HIGHAdobe Acrobat Reader DC Font Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 14.7%CVE-2020-8882HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.916. User interacEPSS 11.1%CVE-2022-43606HIGHA use-of-uninitialized-pointer vulnerability exists in the Forward Open connection_management_entry functionality of EIP Stack Group OpENer EPSS 8.0%CVE-2025-2284HIGHSantesoft Sante PACS Server Access of Uninitialized Pointer DoSEPSS 5.7%CVE-2019-13527—In Rockwell Automation Arena Simulation Software Cat. 9502-Ax, Versions 16.00.00 and earlier, a maliciously crafted Arena file opened by an EPSS 5.3%CVE-2022-31625HIGHFreeing unallocated memory in php_pgsql_free_params()EPSS 3.4%CVE-2022-34228HIGHAdobe Acrobat Reader DC Font Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 3.4%CVE-2006-0054MEDIUMThe ipfw firewall in FreeBSD 6.0-RELEASE allows remote attackers to cause a denial of service (firewall crash) via ICMP IP fragments that maEPSS 3.2%CVE-2018-9981—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 2.7%CVE-2020-6093MEDIUMAn exploitable information disclosure vulnerability exists in the way Nitro Pro 13.9.1.155 does XML error handling. A specially crafted PDF EPSS 2.6%CVE-2019-1869HIGHCisco StarOS Denial of Service VulnerabilityEPSS 2.6%CVE-2023-38223HIGHZDI-CAN-21063: Adobe Acrobat Reader DC Font Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 2.3%CVE-2023-38226HIGHZDI-CAN-21240: Adobe Acrobat Reader DC Font Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 2.3%CVE-2026-3497LOWVulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by vaEPSS 2.2%CVE-2020-27778—A flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote attacker could exploit this flaw by providing a EPSS 2.2%CVE-2023-44365HIGHZDI-CAN-21931: Adobe Acrobat Reader DC Font Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 2.0%CVE-2023-38234HIGHZDI-CAN-21359: Adobe Acrobat Reader DC Font Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 2.0%