Weakness (CWE)
CWE-908: Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
How to prevent it (4 mitigations)
-
Implementation
Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps.
-
Implementation
Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.
-
Implementation
Avoid race conditions (CWE-362) during initialization routines.
-
Build and Compilation
Run or compile the product with settings that generate warnings about uninitialized variables or data.
Source: MITRE CWE-908
299 results · Clear filters · Feed
-
Medium 6.5
Microsoft SQL Server Information Disclosure Vulnerability
Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
-
Medium 6.5
Microsoft Office Word Information Disclosure Vulnerability
Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
-
Medium 5.5
Windows Kernel Transaction Manager Information Disclosure Vulnerability
Use of uninitialized resource in Kernel Transaction Manager allows an authorized attacker to disclose information locally.
-
Medium 6.5
Windows Installer Information Disclosure Vulnerability
Use of uninitialized resource in Windows Installer allows an unauthorized attacker to disclose information over a network.
-
Medium 5.5
Win32k Information Disclosure Vulnerability
Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally.
-
Medium 6.6
Windows Smart Card Elevation of Privilege Vulnerability
Use of uninitialized resource in Windows Smart Card allows an authorized attacker to elevate privileges with a physical attack.
-
Medium 6.5
Windows Advanced Rasterization Platform Information Disclosure Vulnerability
Use of uninitialized resource in Windows Advanced Rasterization Platform allows an authorized attacker to disclose information locally.
-
Medium 5.5
Mailslot File System Information Disclosure Vulnerability
Use of uninitialized resource in Mailslot File System allows an authorized attacker to disclose information locally.
-
Medium 5.9
ASP.NET Core Information Disclosure Vulnerability
Use of uninitialized resource in ASP.NET Core allows an unauthorized attacker to disclose information over a network.
-
Medium 6.5
Microsoft SQL Server Information Disclosure Vulnerability
Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
-
Medium 5.5
Windows Broker Infrastructure Service Information Disclosure Vulnerability
Use of uninitialized resource in Windows Broker Infrastructure Service allows an authorized attacker to disclose information locally.
-
Medium 5.6
Windows Text Services Framework Information Disclosure Vulnerability
Use of uninitialized resource in Windows Text Services Framework allows an authorized attacker to disclose information locally.
-
Medium 5.5
Win32k Information Disclosure Vulnerability
Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Graphics Kernel Information Disclosure Vulnerability
Use of uninitialized resource in Windows Graphics Kernel allows an authorized attacker to disclose information locally.
-
Medium 6.5
Microsoft SQL Server Information Disclosure Vulnerability
Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
-
Medium 5.6
Microsoft Windows Codecs Library Information Disclosure Vulnerability
Use of uninitialized resource in Microsoft Windows Codecs Library allows an authorized attacker to disclose information locally.
-
Medium 4.7
Windows Graphics Kernel Information Disclosure Vulnerability
Use of uninitialized resource in Windows Graphics Kernel allows an authorized attacker to disclose information locally.
-
Medium 4.7
Windows Graphics Kernel Information Disclosure Vulnerability
Use of uninitialized resource in Windows Graphics Kernel allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Kernel Transaction Manager Information Disclosure Vulnerability
Use of uninitialized resource in Kernel Transaction Manager allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Program Compatibility Assistant Service Information Disclosure Vulnerability
Use of uninitialized resource in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information locally.
-
Medium 4.8
Use of uninitialized resource in the MigTD memory for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hy…
-
Medium 4.7
Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outside …
-
Medium 4.7
Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outsid…
-
Medium 4.3
Multiple vulnerabilities in Application Server ABAP of SAP NetWeaver and ABAP Platform
SAP NetWeaver Application Server ABAP and ABAP Platform does not properly initialize memory in certain internal components. Under certain condition, an attacker with low privileges could disclose uninitialized memory contents under specific conditions. This r…
-
Medium 6.5
This Power System update is being released to address
IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, OP940.00 through OP940.A2, OP910.00 through OP910.95, and OP940.00 through OP940.82 could allow a remote attacker to cause a denial of service du…
-
Medium 6.5
Uninitialized resource in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory inside…
-
Medium 6.5
Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had c…
-
Medium 6.5
Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin…
-
Medium 6.5
Uninitialized resource in Images in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-orig…
-
Medium 6.5
MongoDB C Driver GridFS gap lets a shared writer recover a protected client's password
A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialized process memory to be treated as valid file content and stored on the server. A database user holding ordinary write access to a shared storage area…
-
Medium 5.5
FFmpeg 2.3 through 9.0.2 Huffyuv Decoder Uninitialized Heap Memory Disclosure
FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy …
-
Medium 5.5
FFmpeg 0.10 through 9.0.2 Uninitialized Memory Disclosure via Sun Raster Decoder
FFmpeg 0.10 through 9.0.2 contains an uninitialized memory disclosure vulnerability in sunrast_decode_frame() in libavcodec/sunrast.c that leaves decoded image regions unwritten for truncated input. Attackers can supply a crafted truncated Sun Raster image, R…
-
Medium 5.5
FFmpeg 2.1 through 9.0.2 Uninitialized Memory Leak via PCX Decoder
FFmpeg 2.1 through 9.0.2 contains an uninitialized memory disclosure vulnerability in pcx_decode_frame() in libavcodec/pcx.c that leaves scanline buffer bytes uncleared when input ends early. Attackers can supply a crafted truncated RLE-compressed or uncompre…
-
Medium 5.5
SQLite before 3.54.0 Information Disclosure via WAL Page Size Mismatch
SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payloa…
-
Medium 4.3
Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory outsid…
-
Medium 6.5
Information disclosure due to uninitialized memory in the Audio/Video component
Information disclosure due to uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
-
Medium 4.3
VMime through 0.9.2 Uninitialized Stack Memory Disclosure via uuencode Decoder
VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memory into decoded output for over-long lines. Attackers can send a crafted uuencode or x-uuencode MIME part with a large l…
-
Medium 5.5
A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS…
-
Medium 5.5
A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS…
-
Medium 4.0
Cross-document data leak via malformed BSON array parsing in reused thread buffer
A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processed content to be returned when specially crafted serialized input is parsed. An unauthenticated party able to supply seri…