Use of Uninitialized Variable
CWE-457
The code uses a variable that has not been initialized, leading to unpredictable or unintended results.
We track 101 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.1.
How this weakness is prevented
- Implementation: Ensure that critical variables are initialized before first use.
- Build and Compilation: Most compilers will complain about the use of uninitialized variables if warnings are turned on.
- Implementation Operation: When using a language that does not require explicit declaration of variables, run or compile the software in a mode that reports undeclared or unknown variables. This may indicate the presence of a typographic error in the variable's name.
- Requirements: Choose a language that is not susceptible to these issues.
- Architecture and Design: Mitigating technologies such as safe string libraries and container abstractions could be introduced.
Latest Use of Uninitialized Variable vulnerabilities
- 8.8 High severity
Chrome: Use of Uninitialized Resource
Uninitialized Use in Dawn in Google Chrome on Android prior to 127.0.6533.88 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Critical)
- 7.8 High severity
AutoCAD: Use of Uninitialized Resource
A maliciously crafted STP file, when parsed in stp_aim_x64_vc15d.dll through Autodesk applications, can be used to uninitialized variables. This vulnerability, along with other vulnerabilities, can lead to code execution in the current process.
- 7.8 High severity
AutoCAD: Use of Uninitialized Resource
A maliciously crafted MODEL file, when parsed in ASMkern229A.dllthrough Autodesk applications, can be used to uninitialized variables. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.
- 7.8 High severity
SketchUp Viewer: Use of Uninitialized Variable
Trimble SketchUp Viewer SKP File Parsing Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to expl
- 7.8 High severity
PDF-XChange Editor: Use of Uninitialized Resource
PDF-XChange Editor U3D File Parsing Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this v
- 7.8 High severity
Power PDF: Use of Uninitialized Variable
Kofax Power PDF printf Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in
- 7.8 High severity
Cobalt: Use of Uninitialized Variable
Ashlar-Vellum Cobalt Uninitialized Memory Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in
- 7.8 High severity
Linux: Use of Uninitialized Variable
In the Linux kernel, the following vulnerability has been resolved: net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv() Apply the same fix than ones found in : 8d975c15c0cd ("ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()") 1ca1ba4
- 7.5 High severity
Evolution Controller: Use of Uninitialized Resource
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below does not proper sanitize user input, allowing for an unauthenticated attacker to crash the controller software
- 7.8 High severity
SOLIDWORKS Desktop: Heap-based Buffer Overflow
Heap-based Buffer Overflow, Memory Corruption, Out-Of-Bounds Read, Out-Of-Bounds Write, Stack-based Buffer Overflow, Type Confusion, Uninitialized Variable, Use-After-Free vulnerabilities exist in the file reading procedure in SOLIDWORKS Desktop on Release SOL
- 7.8 High severity
eDrawings: Use After Free
Heap-based Buffer Overflow, Memory Corruption, Out-Of-Bounds Read, Out-Of-Bounds Write, Stack-based Buffer Overflow, Type Confusion, Uninitialized Variable, Use-After-Free vulnerabilities exist in the file reading procedure in eDrawings from Release SOLIDWORKS
- 7.5 High severity
fastecdsa: Use of Uninitialized Resource
Versions of the package fastecdsa before 2.3.2 are vulnerable to Use of Uninitialized Variable on the stack, via the curvemath_mul function in src/curveMath.c, due to being used and interpreted as user-defined type. Depending on the variable's actual value it
- 7.8 High severity
AutoCAD: Use of Uninitialized Resource
A maliciously crafted STP or SLDPRT file, when parsed in ODXSW_DLL.dll through Autodesk applications, can be used to uninitialized variables. This vulnerability, along with other vulnerabilities, can lead to code execution in the current process.
- 7.5 High severity
helm: Use of Uninitialized Resource
Helm is a package manager for Charts for Kubernetes. Versions prior to 3.14.2 contain an uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content. When either an `index.yaml` file or a plugins `plugin.yaml` fil
- 7.8 High severity
WPS Office: Use of Uninitialized Resource
An uninitialized pointer use vulnerability exists in the functionality of WPS Office 11.2.0.11537 that handles Data elements in an Excel file. A specially crafted malformed file can lead to remote code execution. An attacker can provide a malicious file to tri
- 7.8 High severity
View: Use of Uninitialized Variable
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.16.02.022. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The
- 7.8 High severity
MicroStation CONNECT: Use of Uninitialized Variable
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a mal
- 7.8 High severity
MicroStation CONNECT: Use of Uninitialized Variable
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a mali
- 7.8 High severity
CPG BIOS: Use of Uninitialized Resource
Dell BIOS contains a use of uninitialized variable vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
- 7.5 High severity
BIG-IP: Use of Uninitialized Resource
In BIG-IP Versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when an iRule containing the HTTP::payload command is configured on a virtual server, undisclosed traffic can cause Traffic Management Microkernel (TMM) to terminate.
- 9.8 Critical severity
Rlc-410w Firmware: Out-of-bounds Write
An out-of-bounds write vulnerability exists in the device TestEmail functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted network request can lead to an out-of-bounds write. An attacker can send an HTTP request to trigger this vulnerabilit