CWE-908: Use of Uninitialized Resource, page 4
Filter
The product uses or accesses a resource that has not been initialized.
What the weakness is: CWE-908 at MITRE
Ask an AI about CWE-908
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CWE-908: Use of Uninitialized Resource and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/908.html and https://cve.bz/cve/cwe/908?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 2.1CVE-2026-6368EPSS 0.1%
Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.
- 6.8CVE-2026-70631EPSS 0.2%
FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply…
- 6.8CVE-2026-70630EPSS 0.2%
FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by sup…
- 6.8CVE-2026-70629EPSS 0.2%
FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted vid…
- 3.3CVE-2026-68744EPSS 0.1%
A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be trans…
- 7.0CVE-2026-64413EPSS 0.1%
In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: zero chainstack array sashiko reports: looking at ebtables table translation, could a sparse cpu_possible_mask lead to an uninitialized pointer f…
- 5.5CVE-2026-64360EPSS 0.1%
In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: zero-initialize buffer in hfs_bnode_read hfs_bnode_read() can return early without writing to the output buffer when is_bnode_offset_valid() fails or when c…
- 5.5CVE-2026-64309EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT) Sashiko notes: > if SEV initialization fails and KVM is actively running normal VMs, could a > userspace proce…
- 7.1CVE-2026-66038EPSS 0.2%
FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer…
- 7.7CVE-2026-66034EPSS 0.4%
libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publick…
- 5.5CVE-2026-64220EPSS 0.1%
In the Linux kernel, the following vulnerability has been resolved: device property: set fwnode->secondary to NULL in fwnode_init() If a firmware node is allocated on the stack (for instance: temporary software node whose life-time we co…
- 7.5CVE-2026-47247EPSS 0.5%
libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to …
- 7.5CVE-2026-16386EPSS 0.4%
Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
- 7.5CVE-2026-16385EPSS 0.4%
Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
- 7.5CVE-2026-16384EPSS 0.4%
Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
- 5.5CVE-2026-64130EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: fix initialization of tags of the huge zero folio with init_on_free __GFP_ZEROTAGS semantics are currently a bit weird, but effectively this flag is only …
- 7.8CVE-2026-64082EPSS 0.1%
In the Linux kernel, the following vulnerability has been resolved: riscv: Fix register corruption from uninitialized cregs on error compat_riscv_gpr_set() calls cregs_to_regs() unconditionally, even when user_regset_copyin() fails. Sinc…
- 5.5CVE-2026-63936EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: iio: adc: mt6359: fix unchecked return value in mt6358_read_imp In mt6358_read_imp(), the variable val_v is passed to regmap_read() but the return value is not checked. …
- 7.8CVE-2026-63870EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() The aoe driver (or similar) generates a non-IPv6 packet (e.g., ETH_P_AOE) and queues it for transmission v…
- 5.5CVE-2026-53379EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov8856: free control handler on error in ov8856_init_controls() The control handler wasn't freed if adding controls failed, add an error exit label and conve…
- 8.8CVE-2026-60005EPSS 0.7%
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send req…
- 6.5CVE-2026-58546EPSS 0.9%
Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.
- 7.5CVE-2026-58535EPSS 0.9%
Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.
- 7.5CVE-2026-58533EPSS 0.9%
Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.
- 6.5CVE-2026-57982EPSS 1.0%
Use of uninitialized resource in Windows RDP allows an authorized attacker to disclose information over a network.
- 5.5CVE-2026-57084EPSS 0.5%
Use of uninitialized resource in Windows File Explorer allows an unauthorized attacker to disclose information locally.
- 5.5CVE-2026-57083EPSS 0.5%
Use of uninitialized resource in Microsoft Windows Codecs Library allows an unauthorized attacker to disclose information locally.
- 9.8CVE-2026-56190EPSS 1.0%
Use of uninitialized resource in Windows RDP allows an unauthorized attacker to execute code over a network.
- 7.8CVE-2026-55949EPSS 0.5%
Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- 5.5CVE-2026-55042EPSS 0.5%
Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally.
- 5.5CVE-2026-50690EPSS 0.4%
Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally.
- 7.5CVE-2026-50497EPSS 0.9%
Off-by-one error in Windows Remote Desktop Protocol allows an unauthorized attacker to disclose information over a network.
- 5.5CVE-2026-50455EPSS 0.4%
Use of uninitialized resource in Universal Plug and Play (upnp.dll) allows an authorized attacker to disclose information locally.
- 6.5CVE-2026-50376EPSS 0.9%
Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.
- 6.5CVE-2026-55003EPSS 0.9%
Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.
- 5.5CVE-2026-54997EPSS 0.4%
Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally.
- 5.5CVE-2026-49801EPSS 0.4%
Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally.
- 7.1CVE-2026-49165EPSS 0.3%
Use of uninitialized resource in Microsoft Windows App Store allows an authorized attacker to disclose information locally.
- 5.5CVE-2026-40422EPSS 0.4%
Use of uninitialized resource in Windows File Explorer allows an authorized attacker to disclose information locally.
- 3.3CVE-2026-56085EPSS 0.1%
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an use of uninitia…
- 5.3CVE-2026-53467EPSS 0.2%
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, the MNG decoder contains a possible heap information disclosure vulnerability because part of the pixe…
- 4.6CVE-2026-6686EPSS 0.3%
FatFs R0.16 and earlier contains an uninitialized cluster exposure when f_lseek() extends files beyond EOF without zero-filling newly allocated clusters. This maps to CWE-908 (Use of Uninitialized Resource). Estimated CVSS v3.1 vector: CVS…
- 5.5CVE-2026-53347EPSS 0.1%
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Fix driver removal with disabled KMS DRM atomic and modesetting aren't initialized if virtio-gpu driver built with disabled KMS, leading to access of uniniti…
- 5.5CVE-2026-53344EPSS 0.1%
In the Linux kernel, the following vulnerability has been resolved: pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init Regmap initialization triggers regcache_maple_populate() which attempts SPI read to populate cach…
- 5.3CVE-2026-54500EPSS 0.2%
Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj.load in :object mode reads uninitialized stack memory (and, for long keys, reads out of bounds) when parsing a JSON object w…
- 8.3CVE-2026-58051EPSS 0.3%
libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an unini…
- 5.5CVE-2026-53311EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: fuse: fix uninit-value in fuse_dentry_revalidate() fuse_dentry_revalidate() may be called with a dentry that didn't had ->d_time initialised. The issue was found with K…
- 5.5CVE-2026-53243EPSS 0.1%
In the Linux kernel, the following vulnerability has been resolved: rseq: Fix using an uninitialized stack variable in rseq_exit_user_update() There is an bug in which an uninitialized stack variable is used in rseq_exit_user_update() as…
- 9.1CVE-2026-53225EPSS 0.6%
In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a par…
- 5.5CVE-2026-53218EPSS 0.1%
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag nft_exthdr_init() passes user-controlled priv->len to nft_parse_register_store(), which marks that many b…