Weakness (CWE)
CWE-908: Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
How to prevent it (4 mitigations)
-
Implementation
Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps.
-
Implementation
Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.
-
Implementation
Avoid race conditions (CWE-362) during initialization routines.
-
Build and Compilation
Run or compile the product with settings that generate warnings about uninitialized variables or data.
Source: MITRE CWE-908
555 results · Feed
-
Medium 4.7
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 154.0.8037.92 allowed a remote attacker to read…
-
Low 3.4
Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had c…
-
Medium 4.7
Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to read memory outside …
-
Low 3.4
Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the…
-
Low 3.7
ImageMagick before 7.1.2-32 and 6.9.13-57 Uninitialized Heap Memory Disclosure in GIF Decoder
ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in coders/gif.c. Attackers can craft malicious GIF files that cause the number parser to read uninitialized heap…
-
High 7.5
Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain un…
-
Medium 5.5
Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin_p
Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin_p. The palette is allocated uninitialised, and only the entries a reader adds count as populated. T…
-
High 7.3
Hamlib: rigctld `send_raw` Stack Out-of-Bounds Write and Uninitialized Memory Disclosure
Hamlib is a ham radio control library for radios, rotators, and amplifiers. Prior to 4.7.2, the unauthenticated rigctld send_raw command on TCP port 4532 reaches rigctl_send_raw() in tests/rigctl_parse.c, which writes a NUL byte at buf[buf_len + 1] outside it…
-
Medium 5.3
OpenSlide: openslide_read_region() returns uninitialized memory with libtiff 4.7.1
OpenSlide is a C library for reading whole slide image files. Prior to 4.0.1, a behavior change in libtiff 4.7.1 causes the indirect TIFF tile path in src/openslide-decode-tiff.c and _openslide_tiff_read_tile() to request a full-height destination for a parti…
-
Medium 4.3
Uninitialized resource in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain cross-origin…
-
Medium 4.7
Uninitialized resource in ANGLE in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to read memory outsid…
-
Medium 6.5
FreeRDP before 3.31.0 Information Disclosure via RDPGFX ResetGraphics
FreeRDP versions before 3.31.0 contain an information disclosure vulnerability in the RDPGFX server's ResetGraphics PDU serializer that fails to initialize padding bytes in the fixed 340-byte wire format. Attackers can receive uninitialized heap memory includ…
-
Medium 6.2
A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 2…
-
Medium 6.8
Netskope Client Endpoint DLP Kernel Driver Information Leakage
An information leakage vulnerability exists in the Endpoint DLP component (epdlpdrv.sys) of Netskope Client for Windows prior to version R141. An internal communication channel used by the user-space hook DLL to pass messages through the kernel driver to the …
-
Medium 4.7
Uninitialized resource in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to read m…
-
Medium 4.3
Uninitialized resource in Codecs in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory insid…
-
Low 3.4
Uninitialized resource in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had c…
-
Medium 4.3
Uninitialized resource in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin …
-
Low 3.4
Uninitialized resource in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised t…
-
Low 3.4
Uninitialized resource in GPU in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the…
-
Medium 5.5
Microsoft Excel Information Disclosure Vulnerability
Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
-
Medium 5.5
Microsoft Excel Information Disclosure Vulnerability
Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
-
Medium 6.5
Microsoft Office Information Disclosure Vulnerability
Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information over a network.
-
High 8.8
Microsoft Office Outlook Remote Code Execution Vulnerability
Use of uninitialized resource in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
-
High 7.5
Windows Failover Cluster Information Disclosure Vulnerability
Use of uninitialized resource in Windows Failover Cluster allows an unauthorized attacker to disclose information over a network.
-
Medium 4.7
Win32k Information Disclosure Vulnerability
Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows DNS Information Disclosure Vulnerability
Use of uninitialized resource in Windows DNS allows an authorized attacker to disclose information locally.
-
High 7.1
Remote Desktop Client Remote Code Execution Vulnerability
Use of uninitialized resource in Remote Desktop Client allows an authorized attacker to execute code over a network.
-
Medium 5.5
Windows GDI+ Information Disclosure Vulnerability
Use of uninitialized resource in Windows GDI+ allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Program Compatibility Assistant Service Information Disclosure Vulnerability
Insertion of sensitive information into log file in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information locally.
-
Medium 5.5
Microsoft Account Information Disclosure Vulnerability
Use of uninitialized resource in Microsoft Account allows an authorized attacker to disclose information locally.
-
Medium 6.5
Microsoft SQL Server Information Disclosure Vulnerability
Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
-
Medium 6.5
Microsoft SQL Server Information Disclosure Vulnerability
Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
-
Medium 6.5
Microsoft SQL Server Information Disclosure Vulnerability
Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
-
High 7.8CVE-2026-85880 Exploited
Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.
KEV Sep 8, 2026 -
Medium 5.5
Win32k Information Disclosure Vulnerability
Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Task Scheduler Information Disclosure Vulnerability
Use of uninitialized resource in Windows Task Scheduler allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Spaceport.sys Information Disclosure Vulnerability
Use of uninitialized resource in Windows Spaceport.sys allows an authorized attacker to disclose information locally.
-
High 8.8
Remote Desktop Client Remote Code Execution Vulnerability
Use of uninitialized resource in Remote Desktop Client allows an authorized attacker to execute code over a network.
-
Medium 5.7
Windows Management Instrumentation Information Disclosure Vulnerability
Use of uninitialized resource in Windows Management Instrumentation allows an authorized attacker to disclose information over a network.