cve.bz

CWE-908: Use of Uninitialized Resource

Filter

The product uses or accesses a resource that has not been initialized.

What the weakness is: CWE-908 at MITRE

Ask an AI about CWE-908

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-908: Use of Uninitialized Resource and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/908.html and https://cve.bz/cve/cwe/908?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.8CVE-2026-120247EPSS 0.1%

    FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA …

  2. 6.8CVE-2026-120245EPSS 0.1%

    FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decoding truncated 1-bit and 4-bit paletted Sun Raster images. Attackers can craft a truncated Sun Raste…

  3. 6.8CVE-2026-120244EPSS 0.1%

    FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows attackers to leak heap memory through truncated RLE scanlines. Attackers can craft a PCX image whose RLE data ends early, causin…

  4. 6.3CVE-2026-119602EPSS 0.3%

    libmspack through 0.11alpha contains an uninitialized memory disclosure vulnerability in the MS-ZIP decompressor that allows attackers to leak heap data via unchecked back-reference distances. Attackers can supply a crafted MS-ZIP CAB file…

  5. 6.8CVE-2026-119375EPSS 0.2%

    SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose ove…

  6. 5.3CVE-2026-116739EPSS 0.3%

    VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memory into decoded output for over-long lines. Attackers can send a crafted uuencode or x-uuencode MIME…

  7. 7.1CVE-2026-81038EPSS 0.1%

    The Object Transfer Service server builds its Object Action Control Point (OACP) response indication in oacp_ind_send() (subsys/bluetooth/services/ots/ots_oacp.c). Before this fix the four-byte Checksum Value field was appended whenever th…

  8. 8.3CVE-2026-116180EPSS 0.3%

    vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empty_cpu() in vllm/v1/outputs.py allocates an uninitialized int32 tensor, and the V1 model runner leaves prompt positions reported as computed by a KV connector u…

  9. 2.1CVE-2026-115386EPSS 0.2%

    Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an information disclosure vulnerability in the WASIp1 fd_readdir implementation that copies uninitialized struct padding into guest memory. Guests with a preo…

  10. 6.3CVE-2026-114651EPSS 0.4%

    A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processed content to be returned when specially crafted serialized input is parsed. An unauthenticated party…

  11. 6.3CVE-2026-114501EPSS 0.4%

    Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im->blocks[0].ptr even when PILLOW_ALIGNMENT makes aligned_linesize include row padding or an a…

  12. 8.7CVE-2026-112897EPSS 0.5%

    Pillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. The _decodeStrip and _decodeTile buffers can be…

  13. 6.3CVE-2026-109438EPSS 0.4%

    3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability that allows unauthenticated attackers to leak stack bytes via the SOCKS4 reply path when the external-NAT option (-Ne…

  14. 8.3CVE-2026-97629EPSS 0.2%

    Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated …

  15. 6.8CVE-2026-104086EPSS 0.2%

    7-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 archive handler (SquashfsHandler.cpp) that allows attackers to leak heap memory by crafting a malicious archive where the superblock’s no_ids f…

  16. 8.8CVE-2026-97011EPSS 0.8%

    Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

  17. 5.5CVE-2026-96850EPSS 0.4%

    Use of uninitialized resource in Windows Modern Device Management (MDM) allows an authorized attacker to disclose information locally.

  18. 5.5CVE-2026-96849EPSS 0.4%

    Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally.

  19. 5.5CVE-2026-96247EPSS 0.4%

    Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally.

  20. 5.5CVE-2026-96206EPSS 0.4%

    Use of uninitialized resource in Windows Subsystem for Linux allows an authorized attacker to disclose information locally.

  21. 8.8CVE-2026-88150EPSS 0.8%

    Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

  22. 7.8CVE-2026-85843EPSS 0.4%

    Use of uninitialized resource in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.

  23. 7.5CVE-2026-85322EPSS 1.0%

    Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.

  24. 5.5CVE-2026-85320EPSS 0.3%

    Use of uninitialized resource in Windows Print Spooler Components allows an authorized attacker to disclose information locally.

  25. 4.7CVE-2026-83925EPSS 0.7%

    Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally.

  26. 5.5CVE-2026-83755EPSS 0.5%

    Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally.

  27. 5.5CVE-2026-83723EPSS 0.5%

    Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally.

  28. 5.5CVE-2026-83714EPSS 0.4%

    Use of uninitialized resource in Windows HTTP.sys allows an authorized attacker to disclose information locally.

  29. 5.5CVE-2026-83695EPSS 0.5%

    Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally.

  30. 7.8CVE-2026-83669EPSS 0.4%

    Use of uninitialized resource in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

  31. 7.5CVE-2026-83515EPSS 1.0%

    Use of uninitialized resource in RPC Runtime allows an unauthorized attacker to disclose information over a network.

  32. 5.5CVE-2026-70293EPSS 0.5%

    Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.

  33. 5.5CVE-2026-70284EPSS 0.5%

    Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.

  34. 5.5CVE-2026-70090EPSS 0.5%

    Use of uninitialized resource in Windows Netlogon allows an authorized attacker to disclose information locally.

  35. 5.5CVE-2026-105731EPSS 0.4%

    Use of uninitialized resource in Microsoft Graphics Component allows an authorized attacker to disclose information locally.

  36. 5.5CVE-2026-102187EPSS 0.5%

    Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally.

  37. 9.6CVE-2026-109745EPSS 0.3%

    Sandbox escape due to uninitialized memory in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  38. 7.1CVE-2026-109712EPSS 0.2%

    Sandbox escape due to uninitialized memory in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  39. 6.9CVE-2026-109273EPSS 0.3%

    ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the PostScript decoder, which allocates a buffer one byte longer than the data it decoded. Attackers can supply a crafted PostScript f…

  40. 7.1CVE-2026-109242EPSS 0.3%

    FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile->current buffer is allocated without zeroing. A malicious RDP server can send a crafted WBT_TILE_FIRST then W…

  41. 4.8CVE-2026-107676EPSS 0.1%

    FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 Bloc…

  42. 6.9CVE-2026-104074EPSS 0.3%

    Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credentials. Attackers can exploit the stun_init_…

  43. 4.7CVE-2026-106395EPSS 0.2%

    Uninitialized resource in Dawn in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  44. 6.5CVE-2026-106386EPSS 0.3%

    Uninitialized resource in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  45. 4.3CVE-2026-106379EPSS 0.2%

    Uninitialized resource in Skia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

  46. 4.7CVE-2026-106376EPSS 0.2%

    Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

  47. 4.7CVE-2026-106370EPSS 0.2%

    Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity:…

  48. 4.7CVE-2026-106290EPSS 0.2%

    Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity:…

  49. 4.7CVE-2026-106275EPSS 0.2%

    Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

  50. 4.7CVE-2026-106273EPSS 0.2%

    Uninitialized resource in Video in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)