Weakness (CWE)
CWE-908: Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
How to prevent it (4 mitigations)
-
Implementation
Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps.
-
Implementation
Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.
-
Implementation
Avoid race conditions (CWE-362) during initialization routines.
-
Build and Compilation
Run or compile the product with settings that generate warnings about uninitialized variables or data.
Source: MITRE CWE-908
560 results · Feed
-
Medium 5.5
Microsoft Office Information Disclosure Vulnerability
Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally.
-
Medium 5.5
Windows Imaging Component Information Disclosure Vulnerability
Use of uninitialized resource in Windows Imaging Component allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Event Logging Service Information Disclosure Vulnerability
Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally.
-
Medium 5.5
Microsoft COM for Windows Information Disclosure Vulnerability
Use of uninitialized resource in Microsoft COM for Windows allows an authorized attacker to disclose information locally.
-
Medium 5.3
Memory Corruption vulnerability in SAP ABAP Platform
SAP ABAP Platform allows an unauthenticated user to send a specially crafted request to an internal component. This could disclose limited, non-sensitive data from previously used memory, leading to a low on confidentiality, with no impact on integrity and av…
-
Low 3.7
UpdateHub probe: uninitialized-heap out-of-bounds read of network-supplied metadata
The UpdateHub OTA client in subsys/mgmt/updatehub/updatehub.c contains an out-of-bounds / uninitialized-memory read in z_impl_updatehub_probe(). The probe response from the UpdateHub server is copied into a heap buffer (metadata) that is correctly NUL-termina…
-
Low 2.1
wordexp with WRDE_APPEND can return or use invalid memory
Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.
-
Medium 5.5
FFmpeg 0.5 < 9.0 Uninitialized Heap Memory Read in TIFF Decoder
FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-com…
-
Medium 5.5
FFmpeg 3.0 < 9.0 Uninitialized Heap Memory Read in Screenpresso Decoder
FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV…
-
Medium 5.5
FFmpeg 3.0 < 9.0 Uninitialized Heap Memory Read in RSCC Decoder
FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compr…
-
Low 3.3
Sssd: sssd: nss responder uninitialized heap disclosure in initgroups reply
A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client…
-
Medium 6.5
FFmpeg LCL/ZLIB Video Decoder Information Disclosure via lcldec.c
FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expe…
-
High 7.5
libssh2 Heap Out-of-Bounds Read via publickey subsystem
libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In lib…
-
High 7.5
libheif Vulnerable to Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation
libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side imag…
-
High 7.5
Information disclosure due to uninitialized memory in the Graphics: WebGPU component
Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
-
High 7.5
Information disclosure due to uninitialized memory in the Graphics: WebGPU component
Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
-
High 7.5
Information disclosure due to uninitialized memory in the Graphics: WebGPU component
Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
-
High 8.2
NGINX ngx_http_slice_module vulnerability
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause…
-
Medium 6.5
Windows Remote Desktop Client Information Disclosure Vulnerability
Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.
-
Medium 6.5
Windows Remote Desktop Client Information Disclosure Vulnerability
Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.
-
Medium 6.5
Windows Remote Desktop Client Information Disclosure Vulnerability
Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.
-
Medium 6.5
Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
Use of uninitialized resource in Windows RDP allows an authorized attacker to disclose information over a network.
-
Medium 5.5
Windows File Explorer Information Disclosure Vulnerability
Use of uninitialized resource in Windows File Explorer allows an unauthorized attacker to disclose information locally.
-
Medium 5.5
Windows Media Photo Codec Information Disclosure Vulnerability
Use of uninitialized resource in Microsoft Windows Codecs Library allows an unauthorized attacker to disclose information locally.
-
Critical 9.8CVE-2026-56190 Public exploit
Remote Desktop Protocol Remote Code Execution Vulnerability
Use of uninitialized resource in Windows RDP allows an unauthorized attacker to execute code over a network.
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
Medium 5.5
Microsoft Office Information Disclosure Vulnerability
Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally.
-
Medium 5.5
Windows SMB Information Disclosure Vulnerability
Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally.
-
Medium 6.5
Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
Off-by-one error in Windows Remote Desktop Protocol allows an unauthorized attacker to disclose information over a network.
-
Medium 5.5
Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability
Use of uninitialized resource in Universal Plug and Play (upnp.dll) allows an authorized attacker to disclose information locally.
-
Medium 6.5
Windows Remote Desktop Client Information Disclosure Vulnerability
Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.
-
Medium 5.5
Windows SMB Information Disclosure Vulnerability
Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows File Explorer Information Disclosure Vulnerability
Use of uninitialized resource in Windows File Explorer allows an authorized attacker to disclose information locally.
-
Medium 6.5
Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.
-
Medium 5.5
Windows SMB Information Disclosure Vulnerability
Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally.
-
High 7.1
Microsoft Windows App Store Information Disclosure Vulnerability
Use of uninitialized resource in Microsoft Windows App Store allows an authorized attacker to disclose information locally.
-
Low 3.3
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 …
-
Medium 5.3
ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, the MNG decoder contains a possible heap information disclosure vulnerability because part of the pixels are left unchange…
-
Medium 4.6
FatFs Use of Uninitialized Clusters After Seek Past EOF
FatFs R0.16 and earlier contains an uninitialized cluster exposure when f_lseek() extends files beyond EOF without zero-filling newly allocated clusters. This maps to CWE-908 (Use of Uninitialized Resource). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N…
-
Medium 5.3
Oj: intern.c form_attr has an uninitialized stack read
Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj.load in :object mode reads uninitialized stack memory (and, for long keys, reads out of bounds) when parsing a JSON object whose key is 254 byte…