Fallos del tipo CWE-824

205 resultados

Ponteiro não inicializado

Ocorre quando um ponteiro é declarado mas nunca recebe um endereço de memória válido antes de ser dereferenciado (acessado). O código tenta ler ou escrever em um endereço aleatório da memória, causando comportamento imprevisível: crash, corrupção de dados ou execução de código arbitrário.

Ejemplo

Um desenvolvedora declara `int *ptr;` em C, depois tenta acessar `*ptr = 42;` sem antes fazer `ptr = malloc(sizeof(int))` ou `ptr = &alguma_variavel;`. O programa escreve em um endereço lixo, quebrando algo na memória ou disparando uma violação de segmentação.

Cómo mitigar

Sempre inicialize ponteiros antes de usar: atribua um endereço válido (alocação dinâmica, referência a variável, ou NULL) no mesmo ponto da declaração. Use ferramentas estáticas (clang-analyzer, valgrind) para detectar casos antes do runtime. Em C++/Rust, prefira smart pointers ou referências, que forçam inicialização.

CVE-2018-9948This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User iEPSS 63.7%CVE-2022-21971HIGHWindows Runtime Remote Code Execution VulnerabilityEPSS 53.9%KEVCVE-2015-1770HIGHMicrosoft Office 2013 SP1 and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft OfEPSS 35.1%KEVCVE-2022-27794HIGHAdobe Acrobat Reader DC Font Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 14.7%CVE-2020-8882HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.916. User interacEPSS 11.1%CVE-2022-43606HIGHA use-of-uninitialized-pointer vulnerability exists in the Forward Open connection_management_entry functionality of EIP Stack Group OpENer EPSS 8.0%CVE-2025-2284HIGHSantesoft Sante PACS Server Access of Uninitialized Pointer DoSEPSS 5.7%CVE-2019-13527In Rockwell Automation Arena Simulation Software Cat. 9502-Ax, Versions 16.00.00 and earlier, a maliciously crafted Arena file opened by an EPSS 5.3%CVE-2022-31625HIGHFreeing unallocated memory in php_pgsql_free_params()EPSS 3.4%CVE-2022-34228HIGHAdobe Acrobat Reader DC Font Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 3.4%CVE-2006-0054MEDIUMThe ipfw firewall in FreeBSD 6.0-RELEASE allows remote attackers to cause a denial of service (firewall crash) via ICMP IP fragments that maEPSS 3.2%CVE-2018-9981This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 2.7%CVE-2020-6093MEDIUMAn exploitable information disclosure vulnerability exists in the way Nitro Pro 13.9.1.155 does XML error handling. A specially crafted PDF EPSS 2.6%CVE-2019-1869HIGHCisco StarOS Denial of Service VulnerabilityEPSS 2.6%CVE-2023-38223HIGHZDI-CAN-21063: Adobe Acrobat Reader DC Font Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 2.3%CVE-2023-38226HIGHZDI-CAN-21240: Adobe Acrobat Reader DC Font Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 2.3%CVE-2026-3497LOWVulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by vaEPSS 2.2%CVE-2020-27778A flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote attacker could exploit this flaw by providing a EPSS 2.2%CVE-2023-44365HIGHZDI-CAN-21931: Adobe Acrobat Reader DC Font Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 2.0%CVE-2023-38234HIGHZDI-CAN-21359: Adobe Acrobat Reader DC Font Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 2.0%