Falhas do tipo CWE-457

227 resultados

Uso de variável não inicializada

Quando o código usa uma variável antes de atribuir um valor válido a ela, o programa pode ler lixo de memória (valores aleatórios deixados por outras operações). Isso leva a comportamentos imprevisíveis, falhas, ou no pior caso, a exploração de segurança quando o atacante consegue controlar o que está naquela posição de memória.

Exemplo

Um buffer local declarado em C sem inicialização (char buf[256];) é usado logo depois em memcpy ou sprintf. Se o conteúdo anterior daquela pilha contiver dados sensíveis ou endereços, um vazamento de informação ou corrupção de fluxo de controle pode ocorrer.

Como mitigar

Inicialize sempre as variáveis na declaração (char buf[256] = {0}; ou int x = 0;). Use análise estática (linters, compiler warnings, ferramentas como clang-analyzer) para detectar uso de variáveis não inicializadas antes do deploy. Em linguagens gerenciadas como Java/C#, o compilador já força isso.

CVE-2024-23137HIGHMultiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareEPSS 1.0%CVE-2024-32611CRITICALHDF5 Library through 1.14.3 may use an uninitialized value in H5A__attr_release_table in H5Aint.c.EPSS 1.0%CVE-2022-28320HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.16.02.022. User interactioEPSS 0.9%CVE-2022-28319HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.034.EPSS 0.9%CVE-2024-26147HIGHHelm's Missing YAML Content Leads To PanicEPSS 0.9%CVE-2024-6990HIGHUninitialized Use in Dawn in Google Chrome on Android prior to 127.0.6533.88 allowed a remote attacker to potentially perform out of bounds EPSS 0.9%CVE-2020-27124HIGHCisco Adaptive Security Appliance Software SSL/TLS Denial of Service VulnerabilityEPSS 0.9%CVE-2021-44003—A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_LoadeEPSS 0.8%CVE-2022-34655HIGHTMM vulnerability CVE-2022-34655EPSS 0.7%CVE-2023-6324HIGHThroughTek Kalay SDK error in handling the PSK identityEPSS 0.7%CVE-2025-20212HIGHA vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series devices could allow an authenticated, remoteEPSS 0.7%CVE-2022-28317HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. EPSS 0.6%CVE-2025-54874MEDIUMOpenJPEG allows OOB heap memory write in opj_jp2_read_headerEPSS 0.6%CVE-2022-42432MEDIUMThis vulnerability allows local attackers to disclose sensitive information on affected installations of the Linux Kernel 6.0-rc2. An attackEPSS 0.6%CVE-2021-3928HIGHUse of Uninitialized Variable in vim/vimEPSS 0.6%CVE-2024-29838HIGHUnsanitised variable on DAL_ADD in Evolution Controller causes application level denial of service and crashEPSS 0.5%CVE-2025-20271HIGHCisco Meraki MX and Z Series AnyConnect VPN with Client Certificate Authentication Denial of Service VulnerabilityEPSS 0.5%CVE-2025-58466LOWQTS, QuTS heroEPSS 0.5%CVE-2025-2024HIGHTrimble SketchUp SKP File Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.4%CVE-2023-42062HIGHPDF-XChange Editor U3D File Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.4%