CWE-908— Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.— MITRE CWE catalog
1,090 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-908page 10 of 22
- CVE-2020-0049MEDIUMCVSS 6.5EG 6.52020-03-10
In onReadBuffer() of StreamingSource.cpp, there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for…
- CVE-2020-6793MEDIUMCVSS 6.5EG 6.52020-03-02
When processing an email message with an ill-formed envelope, Thunderbird could read data from a random memory location. This vulnerability affects Thunderbird < 68.5.
- CVE-2020-0006MEDIUMCVSS 6.5EG 6.52020-01-08
In rw_i93_send_cmd_write_single_block of rw_i93.cc, there is a possible information disclosure of heap memory due to uninitialized data. This could lead to remote information disclosure in the NFC server with no additional execution privil…
- CVE-2019-13751MEDIUMCVSS 6.5EG 6.52019-12-10
Uninitialized data in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
- CVE-2019-9416MEDIUMCVSS 6.5EG 6.52019-09-27
In libstagefright there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: …
- CVE-2019-9415MEDIUMCVSS 6.5EG 6.52019-09-27
In libstagefright there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: …
- CVE-2019-9411MEDIUMCVSS 6.5EG 6.52019-09-27
In libavc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidV…
- CVE-2019-9410MEDIUMCVSS 6.5EG 6.52019-09-27
In libavc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidV…
- CVE-2019-9409MEDIUMCVSS 6.5EG 6.52019-09-27
In libhevc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android…
- CVE-2019-9408MEDIUMCVSS 6.5EG 6.52019-09-27
In libavc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidV…
- CVE-2019-9406MEDIUMCVSS 6.5EG 6.52019-09-27
In libhevc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android…
- CVE-2019-9391MEDIUMCVSS 6.5EG 6.52019-09-27
In libxaac, there is a possible out of bounds read due to uninitialized data. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: …
- CVE-2019-9361MEDIUMCVSS 6.5EG 6.52019-09-27
In libavc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidV…
- CVE-2019-9359MEDIUMCVSS 6.5EG 6.52019-09-27
In libavc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidV…
- CVE-2019-9338MEDIUMCVSS 6.5EG 6.52019-09-27
In libavc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidV…
- CVE-2019-9337MEDIUMCVSS 6.5EG 6.52019-09-27
In libavc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidV…
- CVE-2019-9336MEDIUMCVSS 6.5EG 6.52019-09-27
In libavc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidV…
- CVE-2019-9335MEDIUMCVSS 6.5EG 6.52019-09-27
In libavc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidV…
- CVE-2019-9334MEDIUMCVSS 6.5EG 6.52019-09-27
In libhevc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android…
- CVE-2019-9322MEDIUMCVSS 6.5EG 6.52019-09-27
In libavc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidV…
- CVE-2019-2172MEDIUMCVSS 6.5EG 6.52019-09-27
In libxaac there is a possible information disclosure due to uninitialized data. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersion…
- CVE-2019-2171MEDIUMCVSS 6.5EG 6.52019-09-27
In libxaac there is a possible information disclosure due to uninitialized data. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersion…
- CVE-2019-2170MEDIUMCVSS 6.5EG 6.52019-09-27
In libxaac there is a possible information disclosure due to uninitialized data. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersion…
- CVE-2019-2169MEDIUMCVSS 6.5EG 6.52019-09-27
In libxaac there is a possible information disclosure due to uninitialized data. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersion…
- CVE-2019-2168MEDIUMCVSS 6.5EG 6.52019-09-27
In libxaac there is a possible information disclosure due to uninitialized data. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersion…
- CVE-2019-2167MEDIUMCVSS 6.5EG 6.52019-09-27
In libxaac there is a possible information disclosure due to uninitialized data. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersion…
- CVE-2019-2166MEDIUMCVSS 6.5EG 6.52019-09-27
In libxaac there is a possible information disclosure due to uninitialized data. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersion…
- CVE-2019-2140MEDIUMCVSS 6.5EG 6.52019-09-27
In libxaac, there is a possible information disclosure due to uninitialized data. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersio…
- CVE-2019-11750MEDIUMCVSS 6.5EG 6.52019-09-27
A type confusion vulnerability exists in Spidermonkey, which results in a non-exploitable crash. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1.
- CVE-2018-20992MEDIUMCVSS 6.5EG 6.52019-08-26
An issue was discovered in the claxon crate before 0.4.1 for Rust. Uninitialized memory can be exposed because certain decode buffer sizes are mishandled.
- CVE-2019-5818MEDIUMCVSS 6.5EG 6.52019-06-27
Uninitialized data in media in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file.
- CVE-2018-18366MEDIUMCVSS 6.5EG 6.52019-04-25
Symantec Norton Security prior to 22.16.3, SEP (Windows client) prior to and including 12.1 RU6 MP9, and prior to 14.2 RU1, SEP SBE prior to Cloud Agent 3.00.31.2817, NIS-22.15.2.22, SEP-12.1.7484.7002 and SEP Cloud prior to 22.16.3 may be…
- CVE-2018-6982MEDIUMCVSS 6.5EG 6.52018-12-04
VMware ESXi 6.7 without ESXi670-201811401-BG and VMware ESXi 6.5 without ESXi650-201811301-BG contain uninitialized stack memory usage in the vmxnet3 virtual network adapter which may lead to an information leak from host to guest.
- CVE-2026-96206MEDIUMCVSS 5.5EG 6.52026-10-13
Use of uninitialized resource in Windows Subsystem for Linux allows an authorized attacker to disclose information locally.
- CVE-2026-4147MEDIUMCVSS 4.3EG 6.52026-03-17
An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command.
- CVE-2026-92834MEDIUMCVSS 6.3EG 6.32026-10-02
Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issu…
- CVE-2026-85483MEDIUMCVSS 6.3EG 6.32026-10-02
Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
- CVE-2020-6444MEDIUMCVSS 6.3EG 6.32020-04-13
Uninitialized use in WebRTC in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2026-112897MEDIUMCVSS 6.2EG 6.22026-10-19
Pillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. The _decodeStrip and _decodeTile buffers can be…
- CVE-2026-84622MEDIUMCVSS 6.2EG 6.22026-09-14
A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27.…
- CVE-2018-9378MEDIUMCVSS 6.2EG 6.22025-01-28
In BnAudioPolicyService::onTransact of IAudioPolicyService.cpp, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User inte…
- CVE-2024-38254MEDIUMCVSS 6.2EG 6.22024-09-10
Windows Authentication Information Disclosure Vulnerability
- CVE-2024-31874MEDIUMCVSS 6.2EG 6.22024-04-10
IBM Security Verify Access Appliance 10.0.0 through 10.0.7 uses uninitialized variables when deploying that could allow a local user to cause a denial of service. IBM X-Force ID: 287318.
- CVE-2020-16985MEDIUMCVSS 6.2EG 6.22020-11-11
Azure Sphere Information Disclosure Vulnerability
- CVE-2018-9377MEDIUMCVSS 5.5EG 6.22024-11-28
In getIntentForIntentSender of ActivityManagerService.java, there is a possible way to access user metadata due to a pending intent. This could lead to local escalation of privilege with no additional execution privileges needed. User inte…
- CVE-2023-46100MEDIUMCVSS 5.5EG 6.22023-11-20
in OpenHarmony v3.2.2 and prior versions allow a local attacker get sensitive buffer information through use of uninitialized resource.
- CVE-2026-112632MEDIUMCVSS 6.1EG 6.12026-10-26
An uninitialized memory issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Proc…
- CVE-2024-57878MEDIUMCVSS 6.1EG 6.12025-01-11
In the Linux kernel, the following vulnerability has been resolved: arm64: ptrace: fix partial SETREGSET for NT_ARM_FPMR Currently fpmr_set() doesn't initialize the temporary 'fpmr' variable, and a SETREGSET call with a length of zero wi…
- CVE-2024-57877MEDIUMCVSS 6.1EG 6.12025-01-11
In the Linux kernel, the following vulnerability has been resolved: arm64: ptrace: fix partial SETREGSET for NT_ARM_POE Currently poe_set() doesn't initialize the temporary 'ctrl' variable, and a SETREGSET call with a length of zero will…
- CVE-2024-57874MEDIUMCVSS 6.1EG 6.12025-01-11
In the Linux kernel, the following vulnerability has been resolved: arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL Currently tagged_addr_ctrl_set() doesn't initialize the temporary 'ctrl' variable, and a SETREGSET call …
Map vulnerabilities like CWE-908 to your infrastructure
EchelonGraph correlates every CVE — across CWE-908 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →