CWE-908 · Use of Uninitialized Resource (page 2)
Page 2 of 9 — CVEs classified under CWE-908, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-26175 | Medium | 4.6 | 2026-04-14 | Use of uninitialized resource in Windows Boot Manager allows an unauthorized attacker to bypass a security feature with a physical attack. |
CVE-2026-31428 | Medium | 5.5 | 2026-04-13 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD __build_packet_… |
CVE-2026-31427 | Medium | 5.5 | 2026-04-13 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp process_sdp… |
CVE-2026-34543 | High | 7.5 | 2026-04-01 | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From version 3… |
CVE-2026-27496 | Medium | 6.5 | 2026-03-25 | n8n is an open source workflow automation platform. Prior to versions 1.123.22, 2.9.3, and 2.10.1, an authenticated user with permission to create or modify wo… |
CVE-2026-23358 | Medium | 5.5 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix error handling in slot reset If the device has not recovered after slot r… |
CVE-2026-23317 | High | 7.8 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Return the correct value in vmw_translate_ptr functions Before the referenced… |
CVE-2026-23282 | Medium | 5.5 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix oops due to uninitialised var in smb2_unlink() If SMB2_open_init() or SM… |
CVE-2026-4716 | Critical | 9.1 | 2026-03-24 | Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunder… |
CVE-2026-4715 | Critical | 9.1 | 2026-03-24 | Uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140… |
CVE-2026-4147 | Medium | 6.5 | 2026-03-17 | An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command. |
CVE-2025-12736 | Medium | 6.5 | 2026-03-16 | in OpenHarmony v5.0.3 and prior versions allow a local attacker case sensitive information leak through use of uninitialized resource. |
CVE-2026-3497 | High | 7.5 | 2026-03-12 | Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distrib… |
CVE-2026-2806 | Critical | 9.1 | 2026-02-24 | Uninitialized memory in the Graphics: Text component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
CVE-2026-2794 | High | 7.5 | 2026-02-24 | Information disclosure due to uninitialized memory in Firefox and Firefox Focus for Android. This vulnerability was fixed in Firefox 148. |
CVE-2026-2044 | High | 8.8 | 2026-02-20 | GIMP PGM File Parsing Uninitialized Memory Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affecte… |
CVE-2026-23123 | Medium | 5.5 | 2026-02-14 | In the Linux kernel, the following vulnerability has been resolved: interconnect: debugfs: initialize src_node and dst_node to empty strings The debugfs_crea… |
CVE-2025-12474 | Medium | 4.4 | 2026-02-11 | A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but allocated) memory. This can be done by causing the decoder to r… |
CVE-2026-23101 | Medium | 4.7 | 2026-02-04 | In the Linux kernel, the following vulnerability has been resolved: leds: led-class: Only Add LED to leds_list when it is fully ready Before this change the… |
CVE-2026-24826 | | 2026-01-27 | Out-of-bounds Write, Divide By Zero, NULL Pointer Dereference, Use of Uninitialized Resource, Out-of-bounds Read, Reachable Assertion vulnerability in cadaver… | |
CVE-2026-23007 | Medium | 5.5 | 2026-01-25 | In the Linux kernel, the following vulnerability has been resolved: block: zero non-PI portion of auto integrity buffer The auto-generated integrity buffer f… |
CVE-2026-23003 | High | 7.5 | 2026-01-25 | In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() Blamed commit did not take car… |
CVE-2025-15281 | High | 7.5 | 2026-01-20 | Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialize… |
CVE-2026-0915 | High | 7.5 | 2026-01-15 | Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued netw… |
CVE-2025-71115 | Medium | 5.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: um: init cpu_tasks[] earlier This is currently done in uml_finishsetup(), but e.g. with K… |
CVE-2025-71113 | Medium | 5.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - zero initialize memory allocated via sock_kmalloc Several crypto user AP… |
CVE-2026-20962 | Medium | 4.4 | 2026-01-13 | Use of uninitialized resource in Dynamic Root of Trust for Measurement (DRTM) allows an authorized attacker to disclose information locally. |
CVE-2025-71096 | Medium | 5.5 | 2026-01-13 | In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly The netlink response for… |
CVE-2026-22188 | Medium | 5.5 | 2026-01-07 | The deploy-stub component in Panda3D versions up to and including 1.10.16 contains a denial of service vulnerability due to unbounded stack allocation. The dep… |
CVE-2025-68365 | High | 8.2 | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Initialize allocated memory before use KMSAN reports: Multiple uninitialized va… |
CVE-2025-40829 | High | 7.8 | 2025-12-12 | A vulnerability has been identified in Simcenter Femap (All versions < V2512). The affected applications contains an uninitialized memory vulnerability while p… |
CVE-2025-62472 | High | 7.8 | 2025-12-09 | Use of uninitialized resource in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally. |
CVE-2025-31649 | High | 8.7 | 2025-11-17 | A hard-coded password vulnerability exists in the ControlVault WBDI Driver functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus… |
CVE-2025-31361 | High | 8.7 | 2025-11-17 | A privilege escalation vulnerability exists in the ControlVault WBDI Driver WBIO_USH_ADD_RECORD functionality of Dell ControlVault3 prior to 5.15.14.19 and Del… |
CVE-2025-9640 | Medium | 4.3 | 2025-10-15 | A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authen… |
CVE-2025-59204 | Medium | 5.5 | 2025-10-14 | Use of uninitialized resource in Windows Management Services allows an authorized attacker to disclose information locally. |
CVE-2025-59194 | High | 7.0 | 2025-10-14 | Use of uninitialized resource in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2025-59964 | High | 7.5 | 2025-10-09 | A Use of Uninitialized Resource vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX4700 devices allows an unauthenticated… |
CVE-2022-50546 | High | 7.8 | 2025-10-07 | In the Linux kernel, the following vulnerability has been resolved: ext4: fix uninititialized value in 'ext4_evict_inode' Syzbot found the following issue: =… |
CVE-2023-53578 | High | 7.8 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume() Syzbot reported a bug as… |
CVE-2023-53555 | Medium | 5.5 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: initialize damo_filter->list from damos_new_filter() damos_new_filter() is… |
CVE-2022-50482 | Medium | 5.5 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clean up si_domain in the init_dmars() error path A splat from kmem_cache_des… |
CVE-2022-50473 | Medium | 5.5 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: cpufreq: Init completion before kobject_init_and_add() In cpufreq_policy_alloc(), it will… |
CVE-2025-39931 | High | 7.8 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Set merge to zero early in af_alg_sendmsg If an error causes af_alg_send… |
CVE-2023-53532 | Medium | 5.5 | 2025-10-01 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix deinitialization of firmware resources Currently, in ath11k_ahb_fw_reso… |
CVE-2023-53525 | Medium | 5.5 | 2025-10-01 | In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Allow UD qp_type to join multicast only As for multicast: - The SIDR is the onl… |
CVE-2023-53462 | High | 7.1 | 2025-10-01 | In the Linux kernel, the following vulnerability has been resolved: hsr: Fix uninit-value access in fill_frame_info() Syzbot reports the following uninit-val… |
CVE-2025-39904 | Medium | 5.5 | 2025-10-01 | In the Linux kernel, the following vulnerability has been resolved: arm64: kexec: initialize kexec_buf struct in load_other_segments() Patch series "kexec: F… |
CVE-2023-53351 | Medium | 5.5 | 2025-09-17 | In the Linux kernel, the following vulnerability has been resolved: drm/sched: Check scheduler work queue before calling timeout handling During an IGT GPU r… |
CVE-2023-53344 | Medium | 5.5 | 2025-09-17 | In the Linux kernel, the following vulnerability has been resolved: can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write Syzkaller reported the foll… |
CVE-2023-53341 | Medium | 5.5 | 2025-09-17 | In the Linux kernel, the following vulnerability has been resolved: of/fdt: run soc memory setup when early_init_dt_scan_memory fails If memory has been foun… |
CVE-2022-50374 | Medium | 5.5 | 2025-09-17 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure syzbot is reporting NULL… |
CVE-2022-50346 | Medium | 5.5 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: ext4: init quota for 'old.inode' in 'ext4_rename' Syzbot found the following issue: ext4_… |
CVE-2025-39833 | Medium | 5.5 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: mISDN: hfcpci: Fix warning when deleting uninitialized timer With CONFIG_DEBUG_OBJECTS_TI… |
CVE-2025-39812 | Medium | 5.5 | 2025-09-16 | In the Linux kernel, the following vulnerability has been resolved: sctp: initialize more fields in sctp_v6_from_sk() syzbot found that sin6_scope_id was not… |
CVE-2022-50335 | Critical | 9.8 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: 9p: set req refcount to zero to avoid uninitialized usage When a new request is allocated… |
CVE-2022-50282 | Medium | 5.5 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: chardev: fix error handling in cdev_device_add() While doing fault injection test, I got… |
CVE-2023-53165 | Medium | 5.5 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: udf: Fix uninitialized array access for some pathnames For filenames that begin with . an… |
CVE-2022-50236 | Medium | 5.5 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: iommu/mediatek: Fix crash on isr after kexec() If the system is rebooted via isr(), the I… |
CVE-2025-53799 | Medium | 5.5 | 2025-09-09 | Use of uninitialized resource in Windows Imaging Component allows an unauthorized attacker to disclose information locally. |
CVE-2025-39690 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: iio: accel: sca3300: fix uninitialized iio scan data Fix potential leak of uninitialized… |
CVE-2025-39684 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() syzbot… |
CVE-2025-38737 | Critical | 9.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: cifs: Fix oops due to uninitialised variable Fix smb3_init_transform_rq() to initialise b… |
CVE-2025-38718 | High | 7.8 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: sctp: linearize cloned gso packets in sctp_rcv A cloned head skb still shares these frag… |
CVE-2025-38691 | Medium | 5.5 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix uninited ptr deref in block/scsi layout The error occurs on the third attempt t… |
CVE-2025-36893 | Medium | 5.5 | 2025-09-04 | In ReadTachyonCommands of gxp_main_actor.cc, there is a possible information leak due to uninitialized data. This could lead to local information disclosure wi… |
CVE-2025-38658 | High | 8.8 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: Do not complete commands twice if nvmet_req_init() fails Have nvmet_req_i… |
CVE-2025-38644 | Medium | 5.5 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reject TDLS operations when station is not associated syzbot triggered a… |
CVE-2025-38628 | Medium | 5.5 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix release of uninitialized resources on error path The commit in the fixes t… |
CVE-2025-38613 | Medium | 5.5 | 2025-08-19 | In the Linux kernel, the following vulnerability has been resolved: staging: gpib: fix unset padding field copy back to userspace The introduction of a paddi… |
CVE-2025-38608 | High | 8.6 | 2025-08-19 | In the Linux kernel, the following vulnerability has been resolved: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls When sending plainte… |
CVE-2025-38579 | High | 7.8 | 2025-08-19 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix KMSAN uninit-value in extent_info usage KMSAN reported a use of uninitialized v… |
CVE-2025-38574 | High | 8.6 | 2025-08-19 | In the Linux kernel, the following vulnerability has been resolved: pptp: ensure minimal skb length in pptp_xmit() Commit aabc6596ffb3 ("net: ppp: Add bound… |
CVE-2025-38531 | Medium | 5.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: iio: common: st_sensors: Fix use of uninitialize device structs Throughout the various pr… |
CVE-2025-55198 | Medium | 6.5 | 2025-08-14 | Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, when parsing Chart.yaml and index.yaml files, an improper validation of type erro… |
CVE-2025-53759 | High | 7.8 | 2025-08-12 | Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-53719 | Medium | 5.7 | 2025-08-12 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network. |
CVE-2025-53153 | Medium | 5.7 | 2025-08-12 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network. |
CVE-2025-53148 | Medium | 5.7 | 2025-08-12 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network. |
CVE-2025-53138 | Medium | 5.7 | 2025-08-12 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network. |
CVE-2025-50165 | Critical | 9.8 | 2025-08-12 | Untrusted pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. |
CVE-2025-50157 | Medium | 5.7 | 2025-08-12 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network. |
CVE-2025-50156 | Medium | 5.7 | 2025-08-12 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network. |
CVE-2025-38480 | Medium | 5.5 | 2025-07-28 | In the Linux kernel, the following vulnerability has been resolved: comedi: Fix use of uninitialized data in insn_rw_emulate_bits() For Comedi `INSN_READ` an… |
CVE-2025-38478 | High | 7.8 | 2025-07-28 | In the Linux kernel, the following vulnerability has been resolved: comedi: Fix initialization of data for instructions that write to subdevice Some Comedi s… |
CVE-2025-38472 | Critical | 9.8 | 2025-07-28 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry A crash in connt… |
CVE-2025-38441 | Medium | 5.5 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() syzbot found a… |
CVE-2025-2329 | | 2025-07-25 | In high traffic environments, a Silicon Labs OpenThread RCP (see impacted versions) fails to clear the SPI transmit buffer and may send a corrupt packet over S… | |
CVE-2025-38429 | Critical | 10.0 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: bus: mhi: ep: Update read pointer only after buffer is written Inside mhi_ep_ring_add_ele… |
CVE-2025-38382 | High | 7.8 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix iteration of extrefs during log replay At __inode_add_ref() when processing ex… |
CVE-2025-41239 | High | 7.1 | 2025-07-15 | VMware ESXi, Workstation, Fusion, and VMware Tools contains an information disclosure vulnerability due to the usage of an uninitialised memory in vSockets. A… |
CVE-2025-38309 | Medium | 5.5 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: move xe_svm_init() earlier In xe_vm_close_and_put() we need to be able to call… |
CVE-2025-38277 | Medium | 5.5 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: mtd: nand: ecc-mxic: Fix use of uninitialized variable ret If ctx->steps is zero, the loo… |
CVE-2025-49718 | High | 7.5 | 2025-07-08 | Use of uninitialized resource in SQL Server allows an unauthorized attacker to disclose information over a network. |
CVE-2025-38229 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: media: cxusb: no longer judge rbuf when the write fails syzbot reported a uninit-value in… |
CVE-2025-38225 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: media: imx-jpeg: Cleanup after an allocation error When allocation failures are not clean… |
CVE-2025-38136 | Medium | 5.5 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: usb: renesas_usbhs: Reorder clock handling and power management in probe Reorder the init… |
CVE-2025-38086 | Medium | 5.5 | 2025-06-28 | In the Linux kernel, the following vulnerability has been resolved: net: ch9200: fix uninitialised access during mii_nway_restart In mii_nway_restart() the c… |
CVE-2022-50165 | Medium | 5.5 | 2025-06-18 | In the Linux kernel, the following vulnerability has been resolved: wifi: wil6210: debugfs: fix uninitialized variable use in `wil_write_file_wmi()` Commit 7… |
CVE-2022-50127 | Medium | 5.5 | 2025-06-18 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix error unwind in rxe_create_qp() In the function rxe_create_qp(), rxe_qp_fro… |