Skip to content
OpenAdvisories

Weakness (CWE)

CWE-824: Access of Uninitialized Pointer

Base Incomplete

The product accesses or uses a pointer that has not been initialized.

More detail

If an attacker can influence the portion of uninitialized memory that is contained in the pointer, this weakness could be leveraged to execute code or perform other attacks.

Depending on memory layout, associated memory management behaviors, and product operation, the attacker might be able to influence the contents of the uninitialized pointer, thus gaining more fine-grained control of the memory location to be accessed.

Source: MITRE CWE-824

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.2
    CVE-2026-109619 Exploited Public exploit EPSS 100%

    RCE via stale global state

    PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subs…

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine
    KEV Oct 26, 2026
  • Critical 9.2
    CVE-2026-109618 Exploited Public exploit EPSS 100%

    RCE via OOM corruption

    PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The s…

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine
    KEV Oct 26, 2026
  • High 8.7
    CVE-2026-67281 Public exploit

    Unauthenticated file read in Mikrotik RouterOS

    RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that…

    MikroTik RouterOS Network devices
  • Medium 5.1
    CVE-2022-23636 Public exploit

    Invalid drop of partially-initialized instances in wasmtime

    Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in the pooling instance allocator in Wasmtime's runtime where a failure to instantiate an instance for a module that defines an `externref` glob…

    bytecodealliance wasmtime wasmtime cranelift-codegen crates.io
  • High 7.8
    CVE-2022-21971 Exploited Public exploit EPSS 54%

    Windows Runtime Remote Code Execution Vulnerability

    Windows Runtime Remote Code Execution Vulnerability

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Aug 18, 2022
  • Unscored —
    CVE-2018-9948 Public exploit EPSS 62%

    This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reade…

    Foxit Foxit Reader