Weakness (CWE)
CWE-1419: Incorrect Initialization of Resource
The product attempts to initialize a resource but does not correctly do so, which might leave the resource in an unexpected, incorrect, or insecure state when it is accessed.
More detail
This can have security implications when the associated resource is expected to have certain properties or values. Examples include a variable that determines whether a user has been authenticated or not, or a register or fuse value that determines the security state of the product.
How to prevent it (4 mitigations)
-
Implementation
Choose the safest-possible initialization for security-related resources.
-
Implementation
Ensure that each resource (whether variable, memory buffer, register, etc.) is fully initialized.
-
Implementation
Pay close attention to complex conditionals or reset sources that affect initialization, since some paths might not perform the initialization.
-
Architecture and Design
Ensure that the design and architecture clearly identify what the initialization should be, and that the initialization does not have security implications.
Source: MITRE CWE-1419
2 results · Clear filters · Feed
-
Critical 9.2
RCE via stale global state
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subs…
KEV Oct 26, 2026 -
Critical 9.2
RCE via OOM corruption
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The s…
KEV Oct 26, 2026