Weakness (CWE)
CWE-908: Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
How to prevent it (4 mitigations)
-
Implementation
Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps.
-
Implementation
Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.
-
Implementation
Avoid race conditions (CWE-362) during initialization routines.
-
Build and Compilation
Run or compile the product with settings that generate warnings about uninitialized variables or data.
Source: MITRE CWE-908
551 results · Feed
-
Medium 6.5
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read…
-
Medium 4.3
Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially obtain…
-
Medium 6.5
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to pote…
-
High 8.8
Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read m…
-
Medium 6.5
Uninitialized resource in GPU in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to read m…
-
High 8.8
Uninitialized resource in Video in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside…
-
High 8.8
Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside t…
-
High 8.8
Uninitialized resource in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who had…
-
High 8.8
Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the…
-
High 8.8
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read…
-
High 8.8
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read…
-
High 8.8
Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the…
-
Critical 9.6
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who had…
-
High 8.8
Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory outsid…
-
Medium 6.5
Uninitialized resource in Dawn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory outside…
-
High 8.8
Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised t…
-
High 8.8
Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the…
-
High 8.8
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read…
-
High 8.7
Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
Pillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. The _decodeStrip and _decodeTile buffers can be larger than the byt…
-
Medium 5.3
3proxy 0.9.7 - 1.0.1 Uninitialized Stack Memory Disclosure via SOCKS4
3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability that allows unauthenticated attackers to leak stack bytes via the SOCKS4 reply path when the external-NAT option (-Ne) is configured. Att…
-
Medium 6.5CVE-2026-97629 Public exploit
NGINX ngx_http_ssl_module vulnerability
Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to for…
-
Medium 5.5
7-Zip < 26.03 SquashFS Uninitialized Memory Disclosure via UID/GID Table
7-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 archive handler (SquashfsHandler.cpp) that allows attackers to leak heap memory by crafting a malicious archive where the superblock’s no_ids field is set so that …
-
Medium 5.5
Windows Kernel Information Disclosure Vulnerability
Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally.
-
High 8.8
Microsoft Office Excel Remote Code Execution Vulnerability
Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
-
Medium 5.5
Windows Modern Device Management (MDM) Information Disclosure Vulnerability
Use of uninitialized resource in Windows Modern Device Management (MDM) allows an authorized attacker to disclose information locally.
-
Medium 6.5
Windows Subsystem for Linux Information Disclosure Vulnerability
Use of uninitialized resource in Windows Subsystem for Linux allows an authorized attacker to disclose information locally.
-
Medium 4.7
Windows Kernel Information Disclosure Vulnerability
Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally.
-
Medium 5.5
Win32k Information Disclosure Vulnerability
Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Event Logging Service Information Disclosure Vulnerability
Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally.
-
Medium 5.5
HTTP.sys Information Disclosure Vulnerability
Use of uninitialized resource in Windows HTTP.sys allows an authorized attacker to disclose information locally.
-
Medium 5.5
Win32k Information Disclosure Vulnerability
Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Kernel-Mode Drivers Information Disclosure Vulnerability
Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Kernel-Mode Drivers Information Disclosure Vulnerability
Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally.
-
High 8.8
Microsoft Office Word Remote Code Execution Vulnerability
Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
High 7.8
Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege Vulnerability
Use of uninitialized resource in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.
-
High 7.5
Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability
Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
-
Medium 5.5
Windows Print Spooler Components Information Disclosure Vulnerability
Use of uninitialized resource in Windows Print Spooler Components allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Event Logging Service Information Disclosure Vulnerability
Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally.
-
High 7.8
Windows Error Reporting Elevation of Privilege Vulnerability
Use of uninitialized resource in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
-
Medium 6.5
RPC Runtime Information Disclosure Vulnerability
Use of uninitialized resource in RPC Runtime allows an unauthorized attacker to disclose information over a network.