CWE-908— Use of Uninitialized Resource

The product uses or accesses a resource that has not been initialized.— MITRE CWE catalog

1,020 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-908page 17 of 21

CVE-2023-36713MEDIUMCVSS 5.5EG 5.5
2023-10-10
Windows Common Log File System Driver Information Disclosure Vulnerability
CVE-2023-38140MEDIUMCVSS 5.5EG 5.5
2023-09-12
Windows Kernel Information Disclosure Vulnerability
CVE-2023-21276MEDIUMCVSS 5.5EG 5.5
2023-08-14
In writeToParcel of CursorWindow.cpp, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for …
CVE-2021-0948MEDIUMCVSS 5.5EG 5.5
2023-07-13
The PVRSRVBridgeGetMultiCoreInfo ioctl in the PowerVR kernel driver can return uninitialized kernel memory to user space. The contents of this memory could contain sensitive information.
CVE-2023-35326MEDIUMCVSS 5.5EG 5.5
2023-07-11
Windows CDP User Components Information Disclosure Vulnerability
CVE-2023-32041MEDIUMCVSS 5.5EG 5.5
2023-07-11
Windows Update Orchestrator Service Information Disclosure Vulnerability
CVE-2023-32016MEDIUMCVSS 5.5EG 5.5
2023-06-14
Windows Installer Information Disclosure Vulnerability
CVE-2023-21753MEDIUMCVSS 5.5EG 5.5
2023-01-10
Event Tracing for Windows Information Disclosure Vulnerability
CVE-2022-40768MEDIUMCVSS 5.5EG 5.5
2022-09-18
drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local users to obtain sensitive information from kernel memory because stex_queuecommand_lck lacks a memset for the PASSTHRU_CMD case.
CVE-2021-0887MEDIUMCVSS 5.5EG 5.5
2022-08-24
In PVRSRVBridgeHeapCfgHeapConfigName, there is a possible leak of kernel heap content due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed…
CVE-2021-0698MEDIUMCVSS 5.5EG 5.5
2022-08-24
In PVRSRVBridgeHeapCfgHeapDetails, there is a possible leak of kernel heap content due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed fo…
CVE-2022-20357MEDIUMCVSS 5.5EG 5.5
2022-08-10
In writeToParcel of SurfaceControl.cpp, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed fo…
CVE-2022-34266MEDIUMCVSS 5.5EG 5.5
2022-07-19
The libtiff-4.0.3-35.amzn2.0.1 package for LibTIFF on Amazon Linux 2 allows attackers to cause a denial of service (application crash), a different vulnerability than CVE-2022-0562. When processing a malicious TIFF file, an invalid range m…
CVE-2021-40608MEDIUMCVSS 5.5EG 5.5
2022-06-28
The gf_hinter_track_finalize function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command.
CVE-2022-29205MEDIUMCVSS 5.5EG 5.5
2022-05-20
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, there is a potential for segfault / denial of service in TensorFlow by calling `tf.compat.v1.*` ops which don't yet have support …
CVE-2022-20119MEDIUMCVSS 5.5EG 5.5
2022-05-10
In private_handle_t of mali_gralloc_buffer.h, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not nee…
CVE-2022-0433MEDIUMCVSS 5.5EG 5.5
2022-03-10
A NULL pointer dereference flaw was found in the Linux kernel's BPF subsystem in the way a user triggers the map_get_next_key function of the BPF bloom filter. This flaw allows a local user to crash the system. This flaw affects Linux kern…
CVE-2021-44003MEDIUMCVSS 5.5EG 5.5
2021-12-14
A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll is vulnerable to use of uninitialized memory while parsing user supplied TIFF files. This cou…
CVE-2021-41225MEDIUMCVSS 5.5EG 5.5
2021-11-05
TensorFlow is an open source platform for machine learning. In affected versions TensorFlow's Grappler optimizer has a use of unitialized variable. If the `train_nodes` vector (obtained from the saved model that gets optimized) does not co…
CVE-2021-0938MEDIUMCVSS 5.5EG 5.5
2021-10-25
In memzero_explicit of compiler-clang.h, there is a possible bypass of defense in depth due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not need…
CVE-2021-30027MEDIUMCVSS 5.5EG 5.5
2021-04-29
md_analyze_line in md4c.c in md4c 0.4.7 allows attackers to trigger use of uninitialized memory, and cause a denial of service via a malformed Markdown document.
CVE-2021-21218MEDIUMCVSS 5.5EG 5.5
2021-04-26
Uninitialized data in PDFium in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted PDF file.
CVE-2021-0463MEDIUMCVSS 5.5EG 5.5
2021-03-10
In convertToHidl of convert.cpp, there is a possible out of bounds read due to uninitialized data from ReturnFrameworkMessage. This could lead to local information disclosure with no additional execution privileges needed. User interaction…
CVE-2020-15989MEDIUMCVSS 5.5EG 5.5
2020-11-03
Uninitialized data in PDFium in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted PDF file.
CVE-2020-16855MEDIUMCVSS 5.5EG 5.5
2020-09-11
<p>An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable, which could disclose the contents of memory. An attacker who successfully exploited the vulnerabil…
CVE-2020-1342MEDIUMCVSS 5.5EG 5.5
2020-07-14
An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable, which could disclose the contents of memory, aka 'Microsoft Office Information Disclosure Vulnerabili…
CVE-2020-0101MEDIUMCVSS 5.5EG 5.5
2020-05-14
In BnCrypto::onTransact of ICrypto.cpp, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for explo…
CVE-2020-0048MEDIUMCVSS 5.5EG 5.5
2020-03-10
In onTransact of IAudioFlinger.cpp, there is a possible stack information leak due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for ex…
CVE-2020-0007MEDIUMCVSS 5.5EG 5.5
2020-01-08
In flattenString8 of Sensor.cpp, there is a possible information disclosure of heap memory due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not n…
CVE-2019-18786MEDIUMCVSS 5.5EG 5.5
2019-11-06
In the Linux kernel through 5.3.8, f->fmt.sdr.reserved is uninitialized in rcar_drif_g_fmt_sdr_cap in drivers/media/platform/rcar_drif.c, which could cause a memory disclosure problem.
CVE-2019-9369MEDIUMCVSS 5.5EG 5.5
2019-09-27
In Bluetooth, there is a use of uninitialized variable. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10An…
CVE-2019-1254MEDIUMCVSS 5.5EG 5.5
2019-09-11
An information disclosure vulnerability exists when Windows Hyper-V writes uninitialized memory to disk, aka 'Windows Hyper-V Information Disclosure Vulnerability'.
CVE-2019-1010319MEDIUMCVSS 5.5EG 5.5
2019-07-11
WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseWave64HeaderConfig (wave64.c:211). The attack vector is: Maliciously c…
CVE-2019-1010317MEDIUMCVSS 5.5EG 5.5
2019-07-11
WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseCaffHeaderConfig (caff.c:486). The attack vector is: Maliciously craft…
CVE-2019-2118MEDIUMCVSS 5.5EG 5.5
2019-07-08
In various functions of Parcel.cpp, there are uninitialized or partially initialized stack variables. These could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for explo…
CVE-2019-2104MEDIUMCVSS 5.5EG 5.5
2019-07-08
In HIDL, safe_union, and other C++ structs/unions being sent to application processes, there are uninitialized fields. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not …
CVE-2019-2004MEDIUMCVSS 5.5EG 5.5
2019-06-19
In publishKeyEvent, publishMotionEvent and sendUnchainedFinishedSignal of InputTransport.cpp, there are uninitialized data leading to local information disclosure with no additional execution privileges needed. User interaction is not need…
CVE-2019-9824MEDIUMCVSS 5.5EG 5.5
2019-06-03
tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an snprintf call, leading to Information disclosure.
CVE-2019-11833MEDIUMCVSS 5.5EG 5.5
2019-05-15
fs/ext4/extents.c in the Linux kernel through 5.1.2 does not zero out the unused memory region in the extent tree block, which might allow local users to obtain sensitive information by reading uninitialized data in the filesystem.
CVE-2019-11459MEDIUMCVSS 5.5EG 5.5
2019-04-22
The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince through 3.32.0 did not handle errors from TIFFReadRGBAImageOriented(), leading to uninitialized memory use when processing …
CVE-2018-12011MEDIUMCVSS 5.5EG 5.5
2019-02-11
In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Uninitialized data for socket address leads to information exposure.
CVE-2018-19974MEDIUMCVSS 5.5EG 5.5
2018-12-17
In YARA 3.8.1, bytecode in a specially crafted compiled rule can read uninitialized data from VM scratch memory in libyara/exec.c. This can allow attackers to discover addresses in the real stack (not the YARA virtual stack).
CVE-2018-8627MEDIUMCVSS 5.5EG 5.5
2018-12-12
An information disclosure vulnerability exists when Microsoft Excel software reads out of bound memory due to an uninitialized variable, which could disclose the contents of memory, aka "Microsoft Excel Information Disclosure Vulnerability…
CVE-2018-20029MEDIUMCVSS 5.5EG 5.5
2018-12-10
The nxfs.sys driver in the DokanFS library 0.6.0 in NoMachine before 6.4.6 on Windows 10 allows local users to cause a denial of service (BSOD) because uninitialized memory can be read.
CVE-2018-19626MEDIUMCVSS 5.5EG 5.5
2018-11-29
In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the DCOM dissector could crash. This was addressed in epan/dissectors/packet-dcom.c by adding '\0' termination.
CVE-2018-3970MEDIUMCVSS 5.5EG 5.5
2018-10-25
An exploitable memory disclosure vulnerability exists in the 0x222000 IOCTL handler functionality of Sophos HitmanPro.Alert 3.7.6.744. A specially crafted IRP request can cause the driver to return uninitialized memory, resulting in kernel…
CVE-2018-9499MEDIUMCVSS 5.5EG 5.5
2018-10-02
In readVector of iCrypto.cpp, there is a possible invalid read due to uninitialized data. This could lead to local information disclosure from the DRM server with no additional execution privileges needed. User interaction is not needed fo…
CVE-2018-8378MEDIUMCVSS 5.5EG 5.5
2018-08-15
An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable, which could disclose the contents of memory, aka "Microsoft Office Information Disclosure Vulnerabili…
CVE-2018-11383MEDIUMCVSS 5.5EG 5.5
2018-05-22
The r_strbuf_fini() function in radare2 2.5.0 allows remote attackers to cause a denial of service (invalid free and application crash) via a crafted ELF file because of an uninitialized variable in the CPSE handler in libr/anal/p/anal_avr…
CVE-2017-4905MEDIUMCVSS 5.5EG 5.5
2017-06-07
VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-SG, 5.5 without patch ESXi550-201703401-SG; Workstation Pro / …

Map vulnerabilities like CWE-908 to your infrastructure

EchelonGraph correlates every CVE — across CWE-908 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →