CWE-908— Use of Uninitialized Resource

A vulnerability was found in vLLM up to 0.19.0. The affected element is the function has_mamba_layers of the file vllm/v1/kv_cache_interface.py of the component KV Block Handler. Performing a manipulation results in uninitialized resource.…

Motoko's incremental garbage collector is impacted by an uninitialized memory access bug, caused by incorrect use of write barriers in a few locations. This vulnerability could potentially allow unauthorized read or write access to a Canis…

FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA …

FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decoding truncated 1-bit and 4-bit paletted Sun Raster images. Attackers can craft a truncated Sun Raste…

FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows attackers to leak heap memory through truncated RLE scanlines. Attackers can craft a PCX image whose RLE data ends early, causin…

SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose ove…

A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS…

A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS…

7-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 archive handler (SquashfsHandler.cpp) that allows attackers to leak heap memory by crafting a malicious archive where the superblock’s no_ids…

Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Modern Device Management (MDM) allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows HTTP.sys allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Print Spooler Components allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Netlogon allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Microsoft Graphics Component allows an authorized attacker to disclose information locally.

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where a user could cause uninitialized kernel memory to be copied back to userspace. A successful exploit of this vulnerability might lead to…

Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin_p. The palette is allocated uninitialised, and only the entries a reader adds …

Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

Use of uninitialized resource in Windows DNS allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows GDI+ allows an authorized attacker to disclose information locally.

Insertion of sensitive information into log file in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Microsoft Account allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Task Scheduler allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Spaceport.sys allows an authorized attacker to disclose information locally.

To retrieve the previous timer value, the kernel calls realtimer_gettime(), which obtains the current time for the timer's clock. For a timer using CLOCK_TAI this can fail when no TAI offset has been configured, but the error return was n…

The compat32 kevent() handler translates a 64-bit kevent struct into a stack- declared 32-bit struct. It did not first zero the stack struct. An unprivileged user may observe a small amount of uninitialized kernel stack data, which may c…

The Linux waitid() implementation translates a FreeBSD siginfo_t struct into a stack-declared Linux siginfo_t. It did not first zero the stack struct. An unprivileged user may observe 104 bytes of uninitialized kernel stack data, which m…

Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

Use of uninitialized resource in Windows GDI+ allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally.

Use of uninitialized resource in Windows Imaging Component allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Microsoft COM for Windows allows an authorized attacker to disclose information locally.

FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply…

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by sup…

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted vid…

In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: zero-initialize buffer in hfs_bnode_read hfs_bnode_read() can return early without writing to the output buffer when is_bnode_offset_valid() fails or when c…

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT) Sashiko notes: > if SEV initialization fails and KVM is actively running normal VMs, could a > userspace proce…

In the Linux kernel, the following vulnerability has been resolved: device property: set fwnode->secondary to NULL in fwnode_init() If a firmware node is allocated on the stack (for instance: temporary software node whose life-time we co…

In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: fix initialization of tags of the huge zero folio with init_on_free __GFP_ZEROTAGS semantics are currently a bit weird, but effectively this flag is only …

In the Linux kernel, the following vulnerability has been resolved: iio: adc: mt6359: fix unchecked return value in mt6358_read_imp In mt6358_read_imp(), the variable val_v is passed to regmap_read() but the return value is not checked. …