Weakness (CWE)
CWE-908: Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
How to prevent it (4 mitigations)
-
Implementation
Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps.
-
Implementation
Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.
-
Implementation
Avoid race conditions (CWE-362) during initialization routines.
-
Build and Compilation
Run or compile the product with settings that generate warnings about uninitialized variables or data.
Source: MITRE CWE-908
303 results · Clear filters · Feed
-
Medium 5.5
Windows File Explorer Information Disclosure Vulnerability
Use of uninitialized resource in Windows File Explorer allows an unauthorized attacker to disclose information locally.
-
Medium 5.5
Windows Media Photo Codec Information Disclosure Vulnerability
Use of uninitialized resource in Microsoft Windows Codecs Library allows an unauthorized attacker to disclose information locally.
-
Medium 5.5
Microsoft Office Information Disclosure Vulnerability
Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally.
-
Medium 5.5
Windows SMB Information Disclosure Vulnerability
Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally.
-
Medium 6.5
Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
Off-by-one error in Windows Remote Desktop Protocol allows an unauthorized attacker to disclose information over a network.
-
Medium 5.5
Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability
Use of uninitialized resource in Universal Plug and Play (upnp.dll) allows an authorized attacker to disclose information locally.
-
Medium 6.5
Windows Remote Desktop Client Information Disclosure Vulnerability
Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.
-
Medium 5.5
Windows SMB Information Disclosure Vulnerability
Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows File Explorer Information Disclosure Vulnerability
Use of uninitialized resource in Windows File Explorer allows an authorized attacker to disclose information locally.
-
Medium 6.5
Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.
-
Medium 5.5
Windows SMB Information Disclosure Vulnerability
Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally.
-
Medium 5.3
ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, the MNG decoder contains a possible heap information disclosure vulnerability because part of the pixels are left unchange…
-
Medium 4.6
FatFs Use of Uninitialized Clusters After Seek Past EOF
FatFs R0.16 and earlier contains an uninitialized cluster exposure when f_lseek() extends files beyond EOF without zero-filling newly allocated clusters. This maps to CWE-908 (Use of Uninitialized Resource). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N…
-
Medium 5.3
Oj: intern.c form_attr has an uninitialized stack read
Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj.load in :object mode reads uninitialized stack memory (and, for long keys, reads out of bounds) when parsing a JSON object whose key is 254 byte…
-
Medium 6.5
libssh2 - Free of Uninitialized Pointer in publickey List Cleanup
libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A ma…
-
Medium 5.5
Windows Push Notification Information Disclosure Vulnerability
Use of uninitialized resource in Windows Push Notifications allows an authorized attacker to disclose information locally.
-
Medium 4.2
GHSL-2026-120: 7-Zip SquashFS BlockToNode uninitialized heap read
7-Zip is a file archiver with a high compression ratio. Versions 9.18 through 26.00 contain an uninitialized heap read in the SquashFS archive handler caused by a sparsely populated index array. In the SquashFS handler, _blockToNode is allocated with capacity…
-
Medium 6.5
GHSL-2026-117: 7-Zip UEFI Capsule uninitialized heap memory disclosure
7-Zip is a file archiver with a high compression ratio. Versions 9.21 through 26.00 contain an An uninitialized memory disclosure vulnerability in the UEFI capsule (.scap) parser in 7-Zip. The OpenCapsule function allocates a heap buffer of attacker-declared …
-
Medium 6.5
Uninitialized Use in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the re…
-
Medium 5.3
A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when parsing malformed XLS files. The issue is reach…
-
Medium 6.5
libheif: Uninitialized Heap Memory Information Leak via Failed Grid Tiles
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, when decoding a HEIF grid image with strict_decoding=false (the default), a corrupted tile silently fails to decode and the library returns heif_error_Ok with no indicat…
-
Medium 4.4
ws: Uninitialized memory disclosure
ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.
-
Medium 6.9
Use of uninitialized resource within the AMD Platform Management Framework (PMF) could allow an attacker to read a unin…
-
Medium 5.6
vLLM KV Block kv_cache_interface.py has_mamba_layers uninitialized resource
A vulnerability was found in vLLM up to 0.19.0. The affected element is the function has_mamba_layers of the file vllm/v1/kv_cache_interface.py of the component KV Block Handler. Performing a manipulation results in uninitialized resource. It is possible to i…
-
Medium 4.6
Windows Boot Manager Security Feature Bypass Vulnerability
Use of uninitialized resource in Windows Boot Manager allows an unauthorized attacker to bypass a security feature with a physical attack.
-
Medium 6.5
multimedia_audio_standard has an insecure storage of sensitive information vulnerability
in OpenHarmony v5.0.3 and prior versions allow a local attacker case sensitive information leak through use of uninitialized resource.
-
Medium 6.5
Information disclosure due to uninitialized memory in Firefox and Firefox Focus for Android
Information disclosure due to uninitialized memory in Firefox and Firefox Focus for Android. This vulnerability was fixed in Firefox 148.
-
Medium 4.4
Dynamic Root of Trust for Measurement (DRTM) Information Disclosure Vulnerability
Use of uninitialized resource in Dynamic Root of Trust for Measurement (DRTM) allows an authorized attacker to disclose information locally.
-
Medium 4.3
Samba: vfs_streams_xattr uninitialized memory write possible
A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an inform…
-
Medium 5.5
Windows Management Services Information Disclosure Vulnerability
Use of uninitialized resource in Windows Management Services allows an authorized attacker to disclose information locally.
-
Medium 5.5
arm64: kexec: initialize kexec_buf struct in load_other_segments()
In the Linux kernel, the following vulnerability has been resolved: arm64: kexec: initialize kexec_buf struct in load_other_segments() Patch series "kexec: Fix invalid field access". The kexec_buf structure was previously declared without initialization. comm…
-
Medium 5.5
drm/sched: Check scheduler work queue before calling timeout handling
In the Linux kernel, the following vulnerability has been resolved: drm/sched: Check scheduler work queue before calling timeout handling During an IGT GPU reset test we see again oops despite of commit 0c8c901aaaebc9 (drm/sched: Check scheduler ready before …
-
Medium 5.5
can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write
In the Linux kernel, the following vulnerability has been resolved: can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write Syzkaller reported the following issue: ===================================================== BUG: KMSAN: uninit-value in aio_rw_…
-
Medium 5.5
of/fdt: run soc memory setup when early_init_dt_scan_memory fails
In the Linux kernel, the following vulnerability has been resolved: of/fdt: run soc memory setup when early_init_dt_scan_memory fails If memory has been found early_init_dt_scan_memory now returns 1. If it hasn't found any memory it will return 0, allowing ot…
-
Medium 5.5
Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure syzbot is reporting NULL pointer dereference at hci_uart_tty_close() [1], for rcu_sync_enter() is called without rcu_sync_init…
-
Medium 5.5
ext4: init quota for 'old.inode' in 'ext4_rename'
In the Linux kernel, the following vulnerability has been resolved: ext4: init quota for 'old.inode' in 'ext4_rename' Syzbot found the following issue: ext4_parse_param: s_want_extra_isize=128 ext4_inode_info_init: s_want_extra_isize=32 ext4_rename: old.inode…
-
Medium 5.5
mISDN: hfcpci: Fix warning when deleting uninitialized timer
In the Linux kernel, the following vulnerability has been resolved: mISDN: hfcpci: Fix warning when deleting uninitialized timer With CONFIG_DEBUG_OBJECTS_TIMERS unloading hfcpci module leads to the following splat: [ 250.215892] ODEBUG: assert_init not avail…
-
Medium 5.5
Windows Imaging Component Information Disclosure Vulnerability
Use of uninitialized resource in Windows Imaging Component allows an unauthorized attacker to disclose information locally.
-
Medium 5.5
In ReadTachyonCommands of gxp_main_actor.cc, there is a possible information leak due to uninitialized data. This could…
-
Medium 6.5
Helm May Panic Due To Incorrect YAML Content
Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, when parsing Chart.yaml and index.yaml files, an improper validation of type error can lead to a panic. This issue has been resolved in Helm 3.18.5. A workaround involves ensuring Y…