Weakness (CWE)
CWE-457: Use of Uninitialized Variable
The code uses a variable that has not been initialized, leading to unpredictable or unintended results.
How to prevent it (5 mitigations)
-
Implementation
Ensure that critical variables are initialized before first use [REF-1485].
-
Build and Compilation
Most compilers will complain about the use of uninitialized variables if warnings are turned on.
-
Implementation, Operation
When using a language that does not require explicit declaration of variables, run or compile the software in a mode that reports undeclared or unknown variables. This may indicate the presence of a typographic error in the variable's name.
-
Requirements
Choose a language that is not susceptible to these issues.
-
Architecture and Design
Mitigating technologies such as safe string libraries and container abstractions could be introduced.
Source: MITRE CWE-457
103 results · Clear filters · Feed
-
High 7.5
psqlODBC ODBC escape parser stack buffer overflow
The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a {fn} escape into a fixed 16-entry stack array without a bound and does not initialize the array. An escape with too many arguments overflows the stack, and …
-
High 8.1
Uninitialized memory in the Networking component
Uninitialized memory in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
-
High 8.8
Use of uninitialized variable in Audio in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially…
-
High 8.8
Use of uninitialized variable in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitr…
-
High 8.8
Use of uninitialized variable in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially…
-
High 8.8
Use of uninitialized variable in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially…
-
High 8.8
NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow path
The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length` underflow while processing a `PUT` request. The condition is reachable by an unauthenticated remote client with a single malformed request.
-
High 8.2
Pillow: Invalid free in FreeType glyph rendering when a stroker is active
Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An att…
-
High 8.2
libIEC61850: Server-side out-of-bounds stack read in association-specific dynamic dataset creation due to reversed StringUtils_copyStringToBuffer arguments
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, checkDataSetAccess reverses the source and destination arguments to StringUtils_copyStringToBuffer while…
-
High 8.8
In multiple locations, there is a possible out-of-bounds write due to uninitialized data. This could lead to remote esc…
-
High 8.7
Apache Thrift: c_glib multiplexed processor crashes on a message it cannot route
NULL Pointer Dereference, Use of Uninitialized Variable vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
-
High 7.5
MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash
MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash
-
High 8.1
Uninitialized memory in the Storage: Quota Manager component
Uninitialized memory in the Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
-
High 8.1
OpenBMC IPMI Authentication Bypass via Default userKey and Stale Challenge Value
OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults. The IPMI service then accepts a R…
-
High 8.8
Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component
Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
-
High 7.1
nexthop: initialize extack in nh_res_bucket_migrate()
In the Linux kernel, the following vulnerability has been resolved: nexthop: initialize extack in nh_res_bucket_migrate() nh_res_bucket_migrate() passes an uninitialized netlink_ext_ack to call_nexthop_res_bucket_notifiers(). When nh_notifier_res_bucket_info_…
-
High 7.0
netfilter: ebtables: zero chainstack array
In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: zero chainstack array sashiko reports: looking at ebtables table translation, could a sparse cpu_possible_mask lead to an uninitialized pointer free? If cpu_possible_mask…
-
High 8.8
drm/amdgpu: zero-initialize GART table on allocation
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: zero-initialize GART table on allocation GART TLB is flushed after unmapping but not after mapping. Since amdgpu_bo_create_kernel() does not zero-initialize the buffer, when a sin…
-
High 8.8
Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code in…
-
High 8.3
Uninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the re…
-
High 8.8
Uninitialized Use in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap…
-
High 7.4
Uninitialized Use in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data v…
-
High 8.3
Uninitialized Use in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the r…
-
High 8.3
Uninitialized Use in Gamepad in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who had compromi…
-
High 7.5
Uninitialized Use in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who convinced a user…
-
High 7.8
ceph: add a bunch of missing ceph_path_info initializers
In the Linux kernel, the following vulnerability has been resolved: ceph: add a bunch of missing ceph_path_info initializers ceph_mdsc_build_path() must be called with a zero-initialized ceph_path_info parameter, or else the following ceph_mdsc_free_path_info…
-
High 7.8
mm/page_alloc: clear page->private in free_pages_prepare()
In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: clear page->private in free_pages_prepare() Several subsystems (slub, shmem, ttm, etc.) use page->private but don't clear it before freeing pages. When these pages are later al…
-
High 8.6
xfrm6: fix uninitialized saddr in xfrm6_get_saddr()
In the Linux kernel, the following vulnerability has been resolved: xfrm6: fix uninitialized saddr in xfrm6_get_saddr() xfrm6_get_saddr() does not check the return value of ipv6_dev_get_saddr(). When ipv6_dev_get_saddr() fails to find a suitable source addres…
-
High 7.5
scsi: target: file: Use kzalloc_flex for aio_cmd
In the Linux kernel, the following vulnerability has been resolved: scsi: target: file: Use kzalloc_flex for aio_cmd The target_core_file doesn't initialize the aio_cmd->iocb for the ki_write_stream. When a write command fd_execute_rw_aio() is executed, we ma…
-
High 8.8
netfs: Fix read abandonment during retry
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix read abandonment during retry Under certain circumstances, all the remaining subrequests from a read request will get abandoned during retry. The abandonment process expects the 's…
-
High 7.3
Uninitialized memory in the Audio/Video: Web Codecs component
Uninitialized memory in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
-
High 8.3
Uninitialized Use in Accessibility in Google Chrome on Windows prior to 147.0.7727.101 allowed a remote attacker who ha…
-
High 7.8
drm/vmwgfx: Return the correct value in vmw_translate_ptr functions
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Return the correct value in vmw_translate_ptr functions Before the referenced fixes these functions used a lookup function that returned a pointer. This was changed to another loo…
-
High 7.4
Cisco Nexus 3600-R and 9500-R Series Switching Platforms Layer 2 Loop Denial of Service Vulnerability
A vulnerability with the Ethernet VPN (EVPN) Layer 2 ingress packet processing of Cisco Nexus 3600 Platform Switches and Cisco Nexus 9500-R Series Switching Platforms could allow an unauthenticated, adjacent attacker to trigger a Layer 2 traffic loop. This vu…
-
High 7.8
Use of Uninitialized Variable vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026
A Use of Uninitialized Variable vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026 could allow an attacker to execute arbitrary code while opening a spec…
-
High 8.8
iommu/sva: invalidate stale IOTLB entries for kernel address space
In the Linux kernel, the following vulnerability has been resolved: iommu/sva: invalidate stale IOTLB entries for kernel address space Introduce a new IOMMU interface to flush IOTLB paging cache entries for the CPU kernel address space. This interface is invo…
-
High 7.5CVE-2026-23003 Public exploit
ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() Blamed commit did not take care of VLAN encapsulations as spotted by syzbot [1]. Use skb_vlan_inet_prepare() instead of pskb_inet_ma…
-
High 7.8
drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer Initialize the eb.vma array with values of 0 when the eb structure is first set up. In particular, this sets the eb->v…
-
High 7.8
Use of Uninitialized Variable in HLOS
Memory corruption while processing identity credential operations in the trusted application.
-
High 7.0
A Use of Uninitialized Variable vulnerability exists in Open Design Alliance Drawings SDK static versions (mt) before 2…