CWE-909— Missing Initialization of Resource
The product does not initialize a critical resource.— MITRE CWE catalog
112 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-909page 2 of 3
- CVE-2019-9321MEDIUMCVSS 6.5EG 6.52019-09-27
In libavc, there is a missing variable initialization. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Androi…
- CVE-2019-9320MEDIUMCVSS 6.5EG 6.52019-09-27
In libavc, there is a missing variable initialization. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Androi…
- CVE-2019-9319MEDIUMCVSS 6.5EG 6.52019-09-27
In libavc, there is a missing variable initialization. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Androi…
- CVE-2019-9318MEDIUMCVSS 6.5EG 6.52019-09-27
In libhevc, there is a missing variable initialization. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Andro…
- CVE-2019-9317MEDIUMCVSS 6.5EG 6.52019-09-27
In libstagefright, there is a missing variable initialization. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-…
- CVE-2019-9316MEDIUMCVSS 6.5EG 6.52019-09-27
In libstagefright, there is a missing variable initialization. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-…
- CVE-2019-9315MEDIUMCVSS 6.5EG 6.52019-09-27
In libhevc, there is a missing variable initialization. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Andro…
- CVE-2019-9314MEDIUMCVSS 6.5EG 6.52019-09-27
In libavc, there is a missing variable initialization. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Androi…
- CVE-2019-9313MEDIUMCVSS 6.5EG 6.52019-09-27
In libstagefright, there is a missing variable initialization. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-…
- CVE-2019-9247MEDIUMCVSS 6.5EG 6.52019-09-27
In AAC Codec, there is a missing variable initialization. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10And…
- CVE-2021-40403MEDIUMCVSS 6.3EG 6.32022-02-04
An information disclosure vulnerability exists in the pick-and-place rotation parsing functionality of Gerbv 2.7.0 and dev (commit b5f1eacd), and Gerbv forked 2.8.0. A specially-crafted pick-and-place file can exploit the missing initializ…
- CVE-2026-113351MEDIUMCVSS 5.9EG 5.92026-10-20
libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the sa…
- CVE-2025-38601MEDIUMCVSS 5.5EG 5.52025-08-19
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: clear initialized flag for deinit-ed srng lists In a number of cases we see kernel panics on resume due to ath11k kernel page fault, which happens under th…
- CVE-2025-38532MEDIUMCVSS 5.5EG 5.52025-08-16
In the Linux kernel, the following vulnerability has been resolved: net: libwx: properly reset Rx ring descriptor When device reset is triggered by feature changes such as toggling Rx VLAN offload, wx->do_reset() is called to reinitializ…
- CVE-2022-49217MEDIUMCVSS 5.5EG 5.52025-02-26
In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix abort all task initialization In pm80xx_send_abort_all(), the n_elem field of the ccb used is not initialized to 0. This missing initialization sometim…
- CVE-2024-56676MEDIUMCVSS 5.5EG 5.52024-12-28
In the Linux kernel, the following vulnerability has been resolved: thermal: testing: Initialize some variables annoteded with _free() Variables annotated with __free() need to be initialized if the function can return before they get up…
- CVE-2024-26635MEDIUMCVSS 5.5EG 5.52024-03-18
In the Linux kernel, the following vulnerability has been resolved: llc: Drop support for ETH_P_TR_802_2. syzbot reported an uninit-value bug below. [0] llc supports ETH_P_802_2 (0x0004) and used to support ETH_P_TR_802_2 (0x0011), and …
- CVE-2022-1016MEDIUMCVSS 5.5EG 5.52022-08-29
A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel information leak problem cause…
- CVE-2022-0175MEDIUMCVSS 5.5EG 5.52022-08-26
A flaw was found in the VirGL virtual OpenGL renderer (virglrenderer). The virgl did not properly initialize memory when allocating a host-backed memory resource. A malicious guest could use this flaw to mmap from the guest kernel and read…
- CVE-2022-20357MEDIUMCVSS 5.5EG 5.52022-08-10
In writeToParcel of SurfaceControl.cpp, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed fo…
- CVE-2022-0382MEDIUMCVSS 5.5EG 5.52022-02-11
An information leak flaw was found due to uninitialized memory in the Linux kernel's TIPC protocol subsystem, in the way a user sends a TIPC datagram to one or more destinations. This flaw allows a local user to read some kernel memory. Th…
- CVE-2021-0966MEDIUMCVSS 5.5EG 5.52021-12-15
In code generated by BuildParcelFields of generate_cpp.cpp, there is a possible way for a crafted parcelable to reveal uninitialized memory of a target process due to uninitialized data. This could lead to local information disclosure acro…
- CVE-2021-0423MEDIUMCVSS 5.5EG 5.52021-09-27
In memory management driver, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitat…
- CVE-2021-34693MEDIUMCVSS 5.5EG 5.52021-06-14
net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized.
- CVE-2021-0484MEDIUMCVSS 5.5EG 5.52021-06-11
In readVector of IMediaPlayer.cpp, there is a possible read of uninitialized heap data due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not n…
- CVE-2021-28687MEDIUMCVSS 5.5EG 5.52021-06-11
HVM soft-reset crashes toolstack libxl requires all data structures passed across its public interface to be initialized before use and disposed of afterwards by calling a specific set of functions. Many internal data structures also requi…
- CVE-2021-29647MEDIUMCVSS 5.5EG 5.52021-03-30
An issue was discovered in the Linux kernel before 5.11.11. qrtr_recvmsg in net/qrtr/qrtr.c allows attackers to obtain sensitive information from kernel memory because of a partially uninitialized data structure, aka CID-50535249f624.
- CVE-2020-9227MEDIUMCVSS 5.5EG 5.52020-07-17
Huawei Smart Phones Moana-AL00B with versions earlier than 10.1.0.166 have a missing initialization of resource vulnerability. An attacker tricks the user into installing then running a crafted application. Due to improper initialization o…
- CVE-2020-1419MEDIUMCVSS 5.5EG 5.52020-07-14
An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-1367, CVE-2020-1389, CVE-2…
- CVE-2020-0134MEDIUMCVSS 5.5EG 5.52020-06-11
In BnDrm::onTransact of IDrm.cpp, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for expl…
- CVE-2020-0101MEDIUMCVSS 5.5EG 5.52020-05-14
In BnCrypto::onTransact of ICrypto.cpp, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for explo…
- CVE-2018-19519MEDIUMCVSS 5.5EG 5.52018-11-25
In tcpdump 4.9.2, a stack-based buffer over-read exists in the print_prefix function of print-hncp.c via crafted packet data because of missing initialization.
- CVE-2018-9511MEDIUMCVSS 5.5EG 5.52018-10-02
In ipSecSetEncapSocketOwner of XfrmController.cpp, there is a possible failure to initialize a security feature due to uninitialized data. This could lead to local denial of service of IPsec on sockets with no additional execution privileg…
- CVE-2017-0730MEDIUMCVSS 5.5EG 5.52017-08-09
A denial of service vulnerability in the Android media framework (h264 decoder). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36279112.
- CVE-2021-26333MEDIUMEG 5.52021-09-21
An information disclosure vulnerability exists in AMD Platform Security Processor (PSP) chipset driver. The discretionary access control list (DACL) may allow low privileged users to open a handle and send requests to the driver resulting …
- CVE-2020-12523MEDIUMCVSS 5.4EG 5.42020-12-17
On Phoenix Contact mGuard Devices versions before 8.8.3 LAN ports get functional after reboot even if they are disabled in the device configuration. For mGuard devices with integrated switch on the LAN side, single switch ports can be disa…
- CVE-2021-22482MEDIUMCVSS 5.3EG 5.32021-10-28
There is an Uninitialized variable vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause transmission of invalid data.
- CVE-2020-25579MEDIUMCVSS 5.3EG 5.32021-03-26
In FreeBSD 12.2-STABLE before r368969, 11.4-STABLE before r369047, 12.2-RELEASE before p3, 12.1-RELEASE before p13 and 11.4-RELEASE before p7 msdosfs(5) was failing to zero-fill a pair of padding fields in the dirent structure, resulting i…
- CVE-2020-20739MEDIUMCVSS 5.3EG 5.32020-11-20
im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path or stack address.
- CVE-2026-40687MEDIUMCVSS 4.8EG 4.82026-04-30
In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or erroneous data processing that divulges data from uninitialize…
- CVE-2025-54388MEDIUMCVSS 4.6EG 4.62025-07-30
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. In versions 28.2.0 through 28.3.2, when the firewalld ser…
- CVE-2019-19536MEDIUMCVSS 4.6EG 4.62019-12-03
In the Linux kernel before 5.2.9, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_pro.c driver, aka CID-ead16e53c2f0.
- CVE-2019-19535MEDIUMCVSS 4.6EG 4.62019-12-03
In the Linux kernel before 5.2.9, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_fd.c driver, aka CID-30a8beeb3042.
- CVE-2021-39636MEDIUMCVSS 4.4EG 4.42021-12-15
In do_ipt_get_ctl and do_ipt_set_ctl of ip_tables.c, there is a possible way to leak kernel information due to uninitialized data. This could lead to local information disclosure with system execution privileges needed. User interaction is…
- CVE-2021-0961MEDIUMCVSS 4.4EG 4.42021-12-15
In quota_proc_write of xt_quota2.c, there is a possible way to read kernel memory due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploi…
- CVE-2020-11494MEDIUMCVSS 4.4EG 4.42020-04-02
An issue was discovered in slc_bump in drivers/net/can/slcan.c in the Linux kernel 3.16 through 5.6.2. It allows attackers to read uninitialized can_frame data, potentially containing sensitive information from kernel stack memory, if the …
- CVE-2020-6792MEDIUMCVSS 4.3EG 4.32020-03-02
When deriving an identifier for an email message, uninitialized memory was used in addition to the message contents. This vulnerability affects Thunderbird < 68.5.
- CVE-2025-54410LOWCVSS 3.3EG 3.32025-07-30
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. A firewalld vulnerability affects Moby releases before 28…
- CVE-2022-24448LOWCVSS 3.3EG 3.32022-02-04
An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR shou…
- CVE-2021-3655LOWCVSS 3.3EG 3.32021-08-05
A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1. Missing size validations on inbound SCTP packets may allow the kernel to read uninitialized memory.
Map vulnerabilities like CWE-909 to your infrastructure
EchelonGraph correlates every CVE — across CWE-909 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →