Weakness (CWE)
CWE-908: Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
How to prevent it (4 mitigations)
-
Implementation
Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps.
-
Implementation
Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.
-
Implementation
Avoid race conditions (CWE-362) during initialization routines.
-
Build and Compilation
Run or compile the product with settings that generate warnings about uninitialized variables or data.
Source: MITRE CWE-908
299 results · Clear filters · Feed
-
Medium 6.3
Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1
Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im->blocks[0].ptr even when PILLOW_ALIGNMENT makes aligned_linesize include row padding or an aligned offset before…
-
Medium 6.5
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read…
-
Medium 4.3
Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially obtain…
-
Medium 6.5
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to pote…
-
Medium 6.5
Uninitialized resource in GPU in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to read m…
-
Medium 6.5
Uninitialized resource in Dawn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory outside…
-
Medium 5.3
3proxy 0.9.7 - 1.0.1 Uninitialized Stack Memory Disclosure via SOCKS4
3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability that allows unauthenticated attackers to leak stack bytes via the SOCKS4 reply path when the external-NAT option (-Ne) is configured. Att…
-
Medium 6.5CVE-2026-97629 Public exploit
NGINX ngx_http_ssl_module vulnerability
Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to for…
-
Medium 5.5
7-Zip < 26.03 SquashFS Uninitialized Memory Disclosure via UID/GID Table
7-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 archive handler (SquashfsHandler.cpp) that allows attackers to leak heap memory by crafting a malicious archive where the superblock’s no_ids field is set so that …
-
Medium 5.5
Windows Kernel Information Disclosure Vulnerability
Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Modern Device Management (MDM) Information Disclosure Vulnerability
Use of uninitialized resource in Windows Modern Device Management (MDM) allows an authorized attacker to disclose information locally.
-
Medium 6.5
Windows Subsystem for Linux Information Disclosure Vulnerability
Use of uninitialized resource in Windows Subsystem for Linux allows an authorized attacker to disclose information locally.
-
Medium 4.7
Windows Kernel Information Disclosure Vulnerability
Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally.
-
Medium 5.5
Win32k Information Disclosure Vulnerability
Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Event Logging Service Information Disclosure Vulnerability
Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally.
-
Medium 5.5
HTTP.sys Information Disclosure Vulnerability
Use of uninitialized resource in Windows HTTP.sys allows an authorized attacker to disclose information locally.
-
Medium 5.5
Win32k Information Disclosure Vulnerability
Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Kernel-Mode Drivers Information Disclosure Vulnerability
Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Kernel-Mode Drivers Information Disclosure Vulnerability
Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Print Spooler Components Information Disclosure Vulnerability
Use of uninitialized resource in Windows Print Spooler Components allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Event Logging Service Information Disclosure Vulnerability
Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally.
-
Medium 6.5
RPC Runtime Information Disclosure Vulnerability
Use of uninitialized resource in RPC Runtime allows an unauthorized attacker to disclose information over a network.
-
Medium 5.5
Win32k Information Disclosure Vulnerability
Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Netlogon Information Disclosure Vulnerability
Use of uninitialized resource in Windows Netlogon allows an authorized attacker to disclose information locally.
-
Medium 5.5
Microsoft Office Graphics Component Information Disclosure Vulnerability
Use of uninitialized resource in Microsoft Graphics Component allows an authorized attacker to disclose information locally.
-
Medium 5.3
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure in PostScript Decoder
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the PostScript decoder, which allocates a buffer one byte longer than the data it decoded. Attackers can supply a crafted PostScript file to expose a sing…
-
Medium 5.3
Coturn 4.10.0 Uninitialized Stack Memory Disclosure via ERROR-CODE
Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credentials. Attackers can exploit the stun_init_error_response_commo…
-
Medium 4.7
Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read m…
-
Medium 6.5
Uninitialized resource in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to read memory ins…
-
Medium 4.7
Uninitialized resource in Dawn in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read …
-
Medium 4.7
Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had c…
-
Medium 6.5
Uninitialized resource in Video in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to read memory inside…
-
Medium 4.7
Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had c…
-
Medium 4.7
Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read m…
-
Medium 4.3
Uninitialized resource in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origi…
-
Medium 4.3
Uninitialized resource in Skia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin…
-
Medium 4.7
Uninitialized resource in Video in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised t…
-
Medium 4.7
Uninitialized resource in Dawn in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to read memo…
-
Medium 4.7
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read…
-
Medium 4.7
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read…