Use of Uninitialized Resource
CWE-908
The product uses or accesses a resource that has not been initialized.
We track 173 vulnerabilities of this type. 99% are rated high or critical, and the average CVSS score is 7.9. 4 have been exploited in real attacks.
How this weakness is prevented
- Implementation: Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps.
- Implementation: Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.
- Implementation: Avoid race conditions (CWE-362) during initialization routines.
- Build and Compilation: Run or compile the product with settings that generate warnings about uninitialized variables or data.
Latest Use of Uninitialized Resource vulnerabilities
- 7.5 High severity
SAP NetWeaver (SAP Message Server): Use of Uninitialized Resource
SAP Message Server does not properly handle certain malformed requests, which could be leveraged by an unauthenticated attacker to send specially crafted input. Successful exploitation could allow the attacker to retrieve sensitive information, resulting in a
- 7.1 High severity
proxysql: Use of Uninitialized Resource
ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Prior to 3.0.10, 3.1.10, and 4.0.10, decompress_mysql_payload() in lib/mysql_data_stream.cpp accepts a zlib stream when uncompress() returns Z_OK without checking that the actual output length
- 7.4 High severity
Chrome: Use of Uninitialized Resource
Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 7.4 High severity
Chrome: Use of Uninitialized Resource
Uninitialized resource in Dawn in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 7.4 High severity
Chrome: Use of Uninitialized Resource
Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 7.4 High severity
Chrome: Use of Uninitialized Resource
Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 7.4 High severity
Chrome: Use of Uninitialized Resource
Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Chrome: Use of Uninitialized Resource
Uninitialized resource in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Chrome: Use of Uninitialized Resource
Uninitialized resource in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Chrome: Use of Uninitialized Resource
Uninitialized resource in ANGLE in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 7.1 High severity
zephyr: Reachable Assertion
The Object Transfer Service server builds its Object Action Control Point (OACP) response indication in oacp_ind_send() (subsys/bluetooth/services/ots/ots_oacp.c). Before this fix the four-byte Checksum Value field was appended whenever the requested op code w
- 7.7 High severity
vllm: Use of Uninitialized Resource
vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empty_cpu() in vllm/v1/outputs.py allocates an uninitialized int32 tensor, and the V1 model runner leaves prompt positions reported as computed by a KV connector unwritten. A client sh
- 8.8 High severity
Chrome: Use of Uninitialized Resource
Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Use of Uninitialized Resource
Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Chrome: Use of Uninitialized Resource
Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Chrome: Use of Uninitialized Resource
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Chrome: Use of Uninitialized Resource
Uninitialized resource in Video in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- 9.6 Critical severity
Chrome: Use of Uninitialized Resource
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Chrome: Use of Uninitialized Resource
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Chrome: Use of Uninitialized Resource
Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Chrome: Use of Uninitialized Resource
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Chrome: Use of Uninitialized Resource
Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Use of Uninitialized Resource
Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Chrome: Use of Uninitialized Resource
Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Use of Uninitialized Resource
Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
- 8.8 High severity
Chrome: Use of Uninitialized Resource
Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Use of Uninitialized Resource
Uninitialized resource in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium
- 7.5 High severity
Windows 10 Version 1607: Use of Uninitialized Resource
Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
- 9.6 Critical severity
Firefox: Use of Uninitialized Resource
Sandbox escape due to uninitialized memory in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- 7.1 High severity
Firefox: Use of Uninitialized Resource
Sandbox escape due to uninitialized memory in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- 7.1 High severity
FreeRDP: Use of Uninitialized Resource
FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile->current buffer is allocated without zeroing. A malicious RDP server can send a crafted WBT_TILE_FIRST then WBT_TILE_UPGRADE seque
- 7.8 High severity
GeForce: Use of Uninitialized Resource
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an error-handling path could operate on an improperly initialized resource. A successful exploit of this vulnerability might lead to code execution, escalat
- 7.5 High severity
Exim: Use of Uninitialized Resource
Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.
- 7.3 High severity
Hamlib: Out-of-bounds Write
Hamlib is a ham radio control library for radios, rotators, and amplifiers. Prior to 4.7.2, the unauthenticated rigctld send_raw command on TCP port 4532 reaches rigctl_send_raw() in tests/rigctl_parse.c, which writes a NUL byte at buf[buf_len + 1] outside its
- 7.8 High severity
Microsoft Windows Heap-Based Buffer Overflow Exploited
Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.
- 8.8 High severity
Chrome: Use of Uninitialized Resource
Uninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 7.5 High severity
AIX: Use of Uninitialized Resource
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 A stack memory corruption vulnerability exists in the AIX IPsec ESP decapsulation handler. Successful exploitation may corrupt kernel stack state and cause a system crash, resulting in denial of service.
- 7.5 High severity
i: Use of Uninitialized Resource
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the use of uninitialized memory during ASN.1 length processing.
- 7.5 High severity
Cloud NGFW: Use of Uninitialized Resource
An information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS® software enables an unauthenticated user with network access to obtain sensitive information. Panorama is not impacted by this vulnerability.
- 7.0 High severity
Linux: Use of Uninitialized Resource
In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: zero chainstack array sashiko reports: looking at ebtables table translation, could a sparse cpu_possible_mask lead to an uninitialized pointer free? If cpu_possible_mask