CWE-908: Use of Uninitialized Resource, page 3
Filter
The product uses or accesses a resource that has not been initialized.
What the weakness is: CWE-908 at MITRE
Ask an AI about CWE-908
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CWE-908: Use of Uninitialized Resource and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/908.html and https://cve.bz/cve/cwe/908?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 8.8CVE-2026-69485EPSS 0.9%
Use of uninitialized resource in Remote Desktop Client allows an authorized attacker to execute code over a network.
- 7.1CVE-2026-69358EPSS 0.6%
Use of uninitialized resource in Remote Desktop Client allows an authorized attacker to execute code over a network.
- 5.7CVE-2026-69349EPSS 0.9%
Use of uninitialized resource in Windows Management Instrumentation allows an authorized attacker to disclose information over a network.
- 5.5CVE-2026-69288EPSS 0.4%
Use of uninitialized resource in Windows GDI+ allows an authorized attacker to disclose information locally.
- 5.5CVE-2026-68873EPSS 0.5%
Insertion of sensitive information into log file in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information locally.
- 5.5CVE-2026-68852EPSS 0.5%
Use of uninitialized resource in Microsoft Account allows an authorized attacker to disclose information locally.
- 6.5CVE-2026-68776EPSS 1.0%
Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
- 6.5CVE-2026-67648EPSS 1.0%
Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
- 6.5CVE-2026-67386EPSS 1.0%
Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
- 7.1CVE-2026-85089EPSS 0.4%
FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c (rdp_write_logon_info_v2, rdp_write_logon_info_plain, an…
- 8.8CVE-2026-84326EPSS 0.5%
Uninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 4.3CVE-2026-84267EPSS 0.4%
A flaw was found in the SFTP backend in gvfs. When mounting a share, a malicious SFTP server can cause read_string() to allocate a buffer with a certain length but the function does not verify that the buffer is completely filled, leaving …
- 6.5CVE-2026-79285EPSS 0.4%
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
- 6.5CVE-2026-79270EPSS 0.4%
Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- 4.3CVE-2026-79269EPSS 0.3%
Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
- 6.5CVE-2026-79229EPSS 0.4%
Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- 6.5CVE-2026-79221EPSS 0.2%
Uninitialized resource in Dawn in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- 6.5CVE-2026-79120EPSS 0.3%
Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
- 4.3CVE-2026-79118EPSS 0.3%
Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
- 4.3CVE-2026-79040EPSS 0.3%
Uninitialized resource in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
- 3.1CVE-2026-79007EPSS 0.3%
Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: M…
- 3.1CVE-2026-78986EPSS 0.3%
Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
- 3.4CVE-2026-78984EPSS 0.3%
Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: M…
- 6.5CVE-2026-78977EPSS 0.3%
Uninitialized resource in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
- 6.5CVE-2026-78969EPSS 0.3%
Uninitialized resource in Video in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- 4.3CVE-2026-78965EPSS 0.5%
Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
- 4.3CVE-2026-78962EPSS 0.3%
Uninitialized resource in WebXR in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
- 3.1CVE-2026-78958EPSS 0.3%
Uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
- 6.5CVE-2026-78914EPSS 0.3%
Uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
- 4.3CVE-2026-62986EPSS 0.4%
OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13, the PyOpenEXR Python bindings return stale heap…
- 7.5CVE-2026-19448EPSS 0.4%
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 A stack memory corruption vulnerability exists in the AIX IPsec ESP decapsulation handler. Successful exploitation may corrupt kernel stack state and cause a system crash, resulting in denial o…
- 5.8CVE-2026-63381EPSS 0.2%
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbuffer_add_buffer_reference processes an output buffer whose out_total_len is zero. evbuffer_free_all_chains frees…
- 5.9CVE-2026-16827EPSS 0.4%
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to the use of an uninitialized stack pointer.
- 5.5CVE-2026-58084EPSS 0.1%
To retrieve the previous timer value, the kernel calls realtimer_gettime(), which obtains the current time for the timer's clock. For a timer using CLOCK_TAI this can fail when no TAI offset has been configured, but the error return was n…
- 5.5CVE-2026-49425EPSS 0.2%
The compat32 kevent() handler translates a 64-bit kevent struct into a stack- declared 32-bit struct. It did not first zero the stack struct. An unprivileged user may observe a small amount of uninitialized kernel stack data, which may c…
- 5.5CVE-2026-49424EPSS 0.2%
The Linux waitid() implementation translates a FreeBSD siginfo_t struct into a stack-declared Linux siginfo_t. It did not first zero the stack struct. An unprivileged user may observe 104 bytes of uninitialized kernel stack data, which m…
- 3.3CVE-2026-49423EPSS 0.1%
When building the iovec array for a received TLS 1.2 CBC record, ktls_ocf_tls_cbc_decrypt() incremented the iovec index for every mbuf in the chain, including mbufs that were skipped because they contained only TLS header bytes. This left…
- 4.3CVE-2026-62377EPSS 0.4%
libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heif_context_read_from_memory() can leave the context with no registered sequence tracks and crash when heif_context_get…
- 3.1CVE-2026-76042EPSS 0.3%
Use of uninitialized resource in GPU in Google Chrome prior to 151.0.7922.169 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 7.5CVE-2026-16868EPSS 0.5%
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the use of uninitialized memory during ASN.1 length processing.
- 6.9CVE-2026-70459EPSS 0.7%
rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remote attackers to crash the daemon by sending a file list whose first entry is a dot entry not typed as a directory. The d…
- 1.7CVE-2026-0301EPSS 0.6%
An information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS® software enables an unauthenticated user with network access to obtain sensitive information. Panorama is not impacted by this vulnerabilit…
- 5.5CVE-2026-70317EPSS 0.4%
Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally.
- 5.5CVE-2026-68799EPSS 0.5%
Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
- 5.5CVE-2026-62740EPSS 0.4%
Use of uninitialized resource in Windows Imaging Component allows an authorized attacker to disclose information locally.
- 5.5CVE-2026-62709EPSS 0.4%
Use of uninitialized resource in Windows GDI+ allows an authorized attacker to disclose information locally.
- 5.5CVE-2026-59137EPSS 0.4%
Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally.
- 5.5CVE-2026-59136EPSS 0.4%
Use of uninitialized resource in Microsoft COM for Windows allows an authorized attacker to disclose information locally.
- 5.3CVE-2026-58247EPSS 0.4%
SAP ABAP Platform allows an unauthenticated user to send a specially crafted request to an internal component. This could disclose limited, non-sensitive data from previously used memory, leading to a low on confidentiality, with no impact…
- 3.7CVE-2026-11809EPSS 0.4%
The UpdateHub OTA client in subsys/mgmt/updatehub/updatehub.c contains an out-of-bounds / uninitialized-memory read in z_impl_updatehub_probe(). The probe response from the UpdateHub server is copied into a heap buffer (metadata) that is c…