Weakness (CWE)
CWE-824: Access of Uninitialized Pointer
The product accesses or uses a pointer that has not been initialized.
More detail
If an attacker can influence the portion of uninitialized memory that is contained in the pointer, this weakness could be leveraged to execute code or perform other attacks.
Depending on memory layout, associated memory management behaviors, and product operation, the attacker might be able to influence the contents of the uninitialized pointer, thus gaining more fine-grained control of the memory location to be accessed.
Source: MITRE CWE-824
233 results · Feed
-
High 7.8
ZDI-CAN-21359: Adobe Acrobat Reader DC Font Parsing Uninitialized Variable Remote Code Execution Vulnerability
Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this iss…
-
Critical 9.8
Open Babel has uninitialized pointer dereference in GRO residue parser
A use of uninitialized pointer vulnerability exists in the GRO format res functionality of Open Babel 3.1.1 and master commit 530dbfa3. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigge…
-
Critical 9.8
Open Babel has uninitialized pointer dereference in PQS pFormat
A use of uninitialized pointer vulnerability exists in the PQS format pFormat functionality of Open Babel 3.1.1 and master commit 530dbfa3. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to tr…
-
Critical 9.8
Open Babel has uninitialized pointer dereference in MSI atom parser
A use of uninitialized pointer vulnerability exists in the MSI format atom functionality of Open Babel 3.1.1 and master commit 530dbfa3. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigg…
-
High 7.8
ZDI-CAN-20963: Adobe Substance 3D Designer SBS File Parsing Uninitialized Variable Remote Code Execution Vulnerability
Adobe Substance 3D Designer version 12.4.1 (and earlier) is affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in …
-
Low 3.9
A access of uninitialized pointer vulnerability [CWE-824] vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4, FortiO…
-
High 7.8
The affected product does not properly validate user-supplied data. If a user opens a maliciously formed CSP file, then…
-
Medium 5.9
Usage of Uninitialized Timer during forwarding of Fragments with SFR
RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send crafted frames to the device to trigger the usage of an uninitialized object…
-
High 7.8
A malicious actor may convince a user to open a malicious USD file that may trigger an uninitialized pointer which coul…
-
High 7.8
ZDI-CAN-20371: Adobe Substance 3D Painter GLTF File Parsing Uninitialized Variable Information Disclosure Vulnerability
Adobe Substance 3D Painter versions 8.3.0 (and earlier) is affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in t…
-
Medium 5.5
ZDI-CAN-20369: Adobe Substance 3D Painter USD File Parsing Uninitialized Variable Information Disclosure Vulnerability
Adobe Substance 3D Painter versions 8.3.0 (and earlier) is affected by an Access of Uninitialized Pointer vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploi…
-
High 8.2
H2O vulnerable to read from uninitialized pointer in the reverse proxy handler
H2O is an HTTP server. In versions 2.3.0-beta2 and prior, when the reverse proxy handler tries to processes a certain type of invalid HTTP request, it tries to build an upstream URL by reading from uninitialized pointer. This behavior can lead to crashes or l…
-
Medium 5.5
ZDI-CAN-20266: Adobe Substance 3D Stager USDC File Parsing Uninitialized Variable Information Disclosure Vulnerability
Adobe Substance 3D Stager version 2.0.1 (and earlier) is affected by an Access of Uninitialized Pointer vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploita…
-
Medium 5.5
ZDI-CAN-20265: Adobe Substance 3D Stager USDC File Parsing Uninitialized Variable Information Disclosure Vulnerability
Adobe Substance 3D Stager version 2.0.1 (and earlier) is affected by an Access of Uninitialized Pointer vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploita…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of IronCAD. User interac…
-
High 7.8
ZDI-CAN-20149: Adobe Dimension USD File Parsing Uninitialized Pointer Information Disclosure Vulnerability
Adobe Dimension versions 3.4.7 (and earlier) is affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victi…
-
Medium 5.5
ZDI-CAN-19467: Adobe Dimension USD File Access of Uninitialized Pointer Information Disclosure Vulnerability
Adobe Dimension versions 3.4.7 (and earlier) is affected by an Access of Uninitialized Pointer vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of t…
-
High 7.5
A use-of-uninitialized-pointer vulnerability exists in the Forward Open connection_management_entry functionality of EI…
-
Medium 6.4
An access of uninitialized pointer vulnerability [CWE-824] in the SSL VPN portal of Fortinet FortiOS version 7.2.0 thro…
-
High 7.8
A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected applicatio…
-
High 7.8
A vulnerability has been identified in Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2023 (All versions <…
-
High 7.8
A vulnerability has been identified in Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2023 (All versions <…
-
High 7.8
A vulnerability has been identified in Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2023 (All versions <…
-
High 7.3
Access of uninitialized pointer in Bluetooth HOST
Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP packet.
-
High 7.8
CX-Motion-MCH v2.32 and earlier contains an access of uninitialized pointer vulnerability. Having a user to open a spec…
-
Medium 5.3
Junos OS and Junos OS Evolved: RPD might crash when MPLS ping is performed on BGP LSPs
An Access of Uninitialized Pointer vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a locally authenticated attacker with low privileges to cause a Denial of Service (DoS). When an MPLS ping is perfor…
-
High 8.8
Within the <code>lg_init()</code> function, if several allocations succeed but then one fails, an uninitialized pointer…
-
High 7.8
GE CIMPLICITY Access of Uninitialized Pointer
GE CIMPICITY versions 2022 and prior is vulnerable when data from a faulting address controls code flow starting at gmmiObj!CGmmiRootOptionTable, which could allow an attacker to execute arbitrary code.
-
High 7.8
GE CIMPLICITY Access of Uninitialized Pointer
GE CIMPICITY versions 2022 and prior is vulnerable when data from a faulting address controls code flow starting at gmmiObj!CGmmiOptionContainer, which could allow an attacker to execute arbitrary code.
-
Medium 5.1
Info Leak in l2cap_core in the Linux Kernel
There is an infoleak vulnerability in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_parse_conf_req function which can be used to leak kernel pointers remotely. We recommend upgrading past commit https://github.com/torvalds/linux/commit/b1a2cd50c0357f…
-
High 7.8
Horner Automation's Cscape version 9.90 SP 6 and prior does not properly validate user-supplied data. If a user opens a…
-
High 7.8
Horner Automation's Cscape version 9.90 SP 7 and prior does not properly validate user-supplied data. If a user opens a…
-
High 7.5
Junos OS: SRX Series and MX Series: When specific valid SIP packets are received the PFE will crash
An Access of Uninitialized Pointer vulnerability in SIP Application Layer Gateway (ALG) of Juniper Networks Junos OS on SRX Series and MX Series allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). When specific valid SIP pack…
-
High 7.5
The Triangle Microworks IEC 61850 Library (Any client or server using the C language library with a version number of 1…
-
High 7.8
A vulnerability has been identified in JTTK (All versions < V11.1.1.0), Simcenter Femap V2022.1 (All versions < V2022.1…
-
High 7.8
Adobe Photoshop U3D File Parsing Uninitialized Variable Remote Code Execution Vulnerability
Adobe Photoshop versions 22.5.8 (and earlier) and 23.4.2 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user …
-
High 7.8
Adobe Photoshop U3D File Parsing Uninitialized Variable Remote Code Execution Vulnerability
Adobe Photoshop versions 22.5.8 (and earlier) and 23.4.2 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user …
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022…