Weaknesses of type CWE-908

265 results

Uso de recurso não inicializado

O código usa uma variável, buffer, ponteiro ou outro recurso sem antes atribuir um valor válido ou preparar adequadamente. Isso leva a comportamento imprevisível: o programa pode ler lixo de memória, crashes, ou em casos críticos, permitir exploração de segurança.

Example

Um desenvolvedor declara um array local de 100 bytes sem inicializar, passa ele para uma função que assume valores válidos, e a função processa lixo de memória como se fossem dados legítimos. Ou um ponteiro não inicializado é desreferenciado, causando acesso a endereço inválido.

How to mitigate

Sempre inicialize variáveis e estruturas no momento da declaração (com valores zero, nulos ou adequados ao contexto). Use ferramentas estáticas (linters, sanitizers) que detectam uso de não-inicializados, e configure o compilador para avisar sobre isso (ex: -Wuninitialized em GCC/Clang).

CVE-2023-24941CRITICALWindows Network File System Remote Code Execution VulnerabilityEPSS 94.7%CVE-2008-0081CRITICALUnspecified vulnerability in Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, and Office 2004 for Mac allows user-assisted remote attEPSS 57.9%CVE-2012-1891CRITICALHeap-based buffer overflow in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2 and Windows Data Access Components (WDAC) 6.0 allows rEPSS 29.4%CVE-2009-1529HIGHMicrosoft Internet Explorer 7 for Windows XP SP2 and SP3; 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 dEPSS 28.7%CVE-2024-26209MEDIUMMicrosoft Local Security Authority Subsystem Service Information Disclosure VulnerabilityEPSS 14.8%CVE-2025-50165CRITICALWindows Graphics Component Remote Code Execution VulnerabilityEPSS 9.5%CVE-2024-12085HIGHRsync: info leak via uninitialized stack contentsEPSS 8.7%CVE-2023-36713MEDIUMWindows Common Log File System Driver Information Disclosure VulnerabilityEPSS 8.2%CVE-2025-33070HIGHWindows Netlogon Elevation of Privilege VulnerabilityEPSS 6.8%CVE-2019-13117MEDIUMIn numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumberEPSS 6.5%CVE-2024-43502HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 6.1%CVE-2019-0006CRITICALJunos OS: EX, QFX and MX series: Packet Forwarding Engine manager (FXPC) process crashes due to a crafted HTTP packet in a Virtual Chassis configurationEPSS 5.3%CVE-2019-18197HIGHIn xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area haEPSS 4.5%CVE-2024-38257HIGHMicrosoft AllJoyn API Information Disclosure VulnerabilityEPSS 4.5%CVE-2026-40364HIGHMicrosoft Word Remote Code Execution VulnerabilityEPSS 4.4%CVE-2023-22897MEDIUMAn issue was discovered in SecurePoint UTM before 12.2.5.1. The firewall's endpoint at /spcgi.cgi allows information disclosure of memory coEPSS 4.1%CVE-2025-49718HIGHMicrosoft SQL Server Information Disclosure VulnerabilityEPSS 2.8%CVE-2021-43848HIGHUnititialized memory access in h2oEPSS 2.7%CVE-2025-59194HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 2.5%CVE-2018-25014—A use of uninitialized value was found in libwebp in versions before 1.0.1 in ReadSymbol().EPSS 2.2%