Use of Uninitialized Resource
CWE-908
The product uses or accesses a resource that has not been initialized.
We track 173 vulnerabilities of this type. 99% are rated high or critical, and the average CVSS score is 7.9. 4 have been exploited in real attacks.
How this weakness is prevented
- Implementation: Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps.
- Implementation: Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.
- Implementation: Avoid race conditions (CWE-362) during initialization routines.
- Build and Compilation: Run or compile the product with settings that generate warnings about uninitialized variables or data.
Latest Use of Uninitialized Resource vulnerabilities
- 7.5 High severity
FreeRDP: Use of Uninitialized Resource
FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using `/parallel` command line switch might read uninitialized data and send it to the server the client is currently connected to. FreeRDP based server implem
- 7.8 High severity
CPG BIOS: Use of Uninitialized Resource
Dell BIOS contains a use of uninitialized variable vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
- 8.1 High severity
scylla: Use of Uninitialized Resource
Scylla is a real-time big data database that is API-compatible with Apache Cassandra and Amazon DynamoDB. When decompressing CQL frame received from user, Scylla assumes that user-provided uncompressed length is correct. If user provides fake length, that is g
- 8.1 High severity
samba: Out-of-bounds Read
A flaw was found in Samba. Samba AD users can cause the server to access uninitialized data with an LDAP add or modify the request, usually resulting in a segmentation fault.
- 7.5 High severity
Crow: Use of Uninitialized Resource
HTTP applications (servers) based on Crow through 1.0+4 may reveal potentially sensitive uninitialized data from stack memory when fulfilling a request for a static file smaller than 16 KB.
- 7.5 High severity
BIG-IP: Use of Uninitialized Resource
In BIG-IP Versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when an iRule containing the HTTP::payload command is configured on a virtual server, undisclosed traffic can cause Traffic Management Microkernel (TMM) to terminate.
- 9.8 Critical severity
MT2621, MT2625: Use of Uninitialized Resource
In httpclient, there is a possible out of bounds write due to uninitialized data. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WSAP00103831; Issue I
- 8.8 High severity
Qemu: Use of Uninitialized Resource
softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_readx or io_writex crash. NOTE: a third party states that the Non-virtualization Use Case in the qemu.org reference applies here, i.e., "Bugs
- 7.5 High severity
@discordjs/opus: Use of Uninitialized Resource
All versions of package @discordjs/opus are vulnerable to Denial of Service (DoS) when trying to encode using an encoder with zero channels, or a non-initialized buffer. This leads to a hard crash.
- 7.5 High severity
trilogy: Use of Uninitialized Resource
Trilogy is a client library for MySQL. When authenticating, a malicious server could return a specially crafted authentication packet, causing the client to read and return up to 12 bytes of data from an uninitialized variable in stack memory. Users of the tri
- 7.5 High severity
BIG-IP: Use of Uninitialized Resource
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, and 14.1.x versions prior to 14.1.4.6, when a Session Initiation Protocol (SIP) message routing framework (MRF) application layer gateway (ALG) profile is configured on a Message
- 8.8 High severity
Chrome: Use of Uninitialized Resource
Uninitialized use in File API in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
- 8.8 High severity
tensorflow: Use of Uninitialized Resource
Tensorflow is an Open Source Machine Learning Framework. The implementation of `AssignOp` can result in copying uninitialized data to a new tensor. This later results in undefined behavior. The implementation has a check that the left hand side of the assignme