CWE-908 · Use of Uninitialized Resource (page 2)
Page 2 of 9 — CVEs classified under CWE-908, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-57083 | Medium | 5.5 | 2026-07-14 | Use of uninitialized resource in Microsoft Windows Codecs Library allows an unauthorized attacker to disclose information locally. |
CVE-2026-56190 | Critical | 9.8 | 2026-07-14 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to execute code over a network. |
CVE-2026-55949 | High | 7.8 | 2026-07-14 | Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-55042 | Medium | 5.5 | 2026-07-14 | Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-50690 | Medium | 5.5 | 2026-07-14 | Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally. |
CVE-2026-50497 | Medium | 6.5 | 2026-07-14 | Off-by-one error in Windows Remote Desktop Protocol allows an unauthorized attacker to disclose information over a network. |
CVE-2026-50455 | Medium | 5.5 | 2026-07-14 | Use of uninitialized resource in Universal Plug and Play (upnp.dll) allows an authorized attacker to disclose information locally. |
CVE-2026-50376 | Medium | 6.5 | 2026-07-14 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. |
CVE-2026-55003 | Medium | 6.5 | 2026-07-14 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. |
CVE-2026-54997 | Medium | 5.5 | 2026-07-14 | Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally. |
CVE-2026-49801 | Medium | 5.5 | 2026-07-14 | Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally. |
CVE-2026-49165 | High | 7.1 | 2026-07-14 | Use of uninitialized resource in Microsoft Windows App Store allows an authorized attacker to disclose information locally. |
CVE-2026-40422 | Medium | 5.5 | 2026-07-14 | Use of uninitialized resource in Windows File Explorer allows an authorized attacker to disclose information locally. |
CVE-2026-56085 | Low | 3.3 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30… |
CVE-2026-53467 | Medium | 5.3 | 2026-07-01 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, the MNG decoder contai… |
CVE-2026-6686 | Medium | 4.6 | 2026-07-01 | FatFs R0.16 and earlier contains an uninitialized cluster exposure when f_lseek() extends files beyond EOF without zero-filling newly allocated clusters. This… |
CVE-2026-53347 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Fix driver removal with disabled KMS DRM atomic and modesetting aren't initia… |
CVE-2026-53344 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init Regmap initializa… |
CVE-2026-54500 | Medium | 5.3 | 2026-07-01 | Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj.load in :object mode reads uninitialized sta… |
CVE-2026-58051 | Medium | 6.5 | 2026-06-28 | libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure re… |
CVE-2026-53311 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: fuse: fix uninit-value in fuse_dentry_revalidate() fuse_dentry_revalidate() may be called… |
CVE-2026-53243 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: rseq: Fix using an uninitialized stack variable in rseq_exit_user_update() There is an bu… |
CVE-2026-53225 | Critical | 9.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sc… |
CVE-2026-53218 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag nft_exthdr_init() passes… |
CVE-2026-53170 | High | 8.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: reject DMA commands with uninitialized length cmd_state_init() initializes… |
CVE-2026-53167 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios FUSE_NOTIFY_RETRIEVE must be limited… |
CVE-2026-53142 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/display: fix oops in suspend/shutdown without display The xe driver keeps track of… |
CVE-2026-53082 | Medium | 5.5 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf sixpack_receive_buf() does… |
CVE-2026-53029 | Medium | 5.5 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: prevent uninitialized lcn caused by zero len syzbot reported a uninit-value in… |
CVE-2026-52989 | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers Currently, when nv… |
CVE-2026-52985 | Medium | 5.5 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: netdevsim: zero initialize struct iphdr in dummy sk_buff Syzbot reports a KMSAN uninit-va… |
CVE-2026-56968 | Low | 3.7 | 2026-06-23 | GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a craf… |
CVE-2026-11576 | High | 7.5 | 2026-06-19 | The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this… |
CVE-2026-42969 | Medium | 5.5 | 2026-06-09 | Use of uninitialized resource in Windows Push Notifications allows an authorized attacker to disclose information locally. |
CVE-2026-48104 | Medium | 4.2 | 2026-06-05 | 7-Zip is a file archiver with a high compression ratio. Versions 9.18 through 26.00 contain an uninitialized heap read in the SquashFS archive handler caused b… |
CVE-2026-48101 | Medium | 6.5 | 2026-06-05 | 7-Zip is a file archiver with a high compression ratio. Versions 9.21 through 26.00 contain an An uninitialized memory disclosure vulnerability in the UEFI cap… |
CVE-2026-11089 | Medium | 6.5 | 2026-06-04 | Uninitialized Use in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sen… |
CVE-2026-26825 | Medium | 5.3 | 2026-06-03 | A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when parsing malformed XLS files. The issue is reachable via xls_parseWorkBook() and is trig… |
CVE-2026-46257 | Medium | 5.5 | 2026-06-03 | In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/timer-sp804: Fix an Oops when read_current_timer is called on ARM32 pl… |
CVE-2026-46186 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtio_bt: validate rx pkt_type header length virtbt_rx_handle() reads the lea… |
CVE-2026-46169 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix uninit-value by validating catalog record size Syzbot reported a KMSAN unini… |
CVE-2026-46167 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Just like in a previous pro… |
CVE-2026-46139 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: smb: client: use kzalloc to zero-initialize security descriptor buffer Commit 62e7dd0a39c… |
CVE-2026-46132 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo rtnl_f… |
CVE-2026-47272 | High | 7.1 | 2026-05-27 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, the pusb_pad_compare() function in src/pad.c only verified t… |
CVE-2026-45886 | Medium | 5.5 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpf_xdp_store_bytes proto for read-only arg While making some maps in Cilium rea… |
CVE-2025-71311 | High | 8.2 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Initialize new folios before use KMSAN reports an uninitialized value in longes… |
CVE-2026-32814 | Medium | 6.5 | 2026-05-19 | libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, when decoding a HEIF grid image with strict_decoding=false (the defau… |
CVE-2026-45736 | Medium | 4.4 | 2026-05-15 | ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory discl… |
CVE-2025-48513 | | 2026-05-15 | Use of uninitialized resource within the AMD Platform Management Framework (PMF) could allow an attacker to read a uninitialized kernel memory resulting in los… | |
CVE-2026-40364 | High | 8.4 | 2026-05-12 | Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2026-43474 | Medium | 5.5 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: fs: init flags_valid before calling vfs_fileattr_get syzbot reported a uninit-value bug i… |
CVE-2026-43472 | Medium | 5.5 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: unshare: fix unshare_fs() handling There's an unpleasant corner case in unshare(2), when… |
CVE-2026-43456 | High | 7.8 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: bonding: fix type confusion in bond_setup_by_slave() kernel BUG at net/core/skbuff.c:2306… |
CVE-2026-43405 | High | 7.5 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: libceph: Use u32 for non-negative values in ceph_monmap_decode() This patch fixes unneces… |
CVE-2026-43349 | Medium | 5.5 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid uninit-value access in f2fs_sanity_check_node_footer syzbot reported a… |
CVE-2026-43291 | High | 8.3 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: net: nfc: nci: Fix parameter validation for packet data Since commit 9c328f54741b ("net… |
CVE-2026-43288 | Medium | 5.5 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: ext4: move ext4_percpu_param_init() before ext4_mb_init() When running `kvm-xfstests -c e… |
CVE-2026-43221 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: initialise event handler read bytes IPMB doesn't use i2c reads, but the handl… |
CVE-2026-43160 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: mfd: macsmc: Initialize mutex Initialize struct apple_smc's mutex in apple_smc_probe(). U… |
CVE-2026-43139 | High | 8.6 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: xfrm6: fix uninitialized saddr in xfrm6_get_saddr() xfrm6_get_saddr() does not check the… |
CVE-2026-43036 | Medium | 5.5 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: net: use skb_header_pointer() for TCPv4 GSO frag_off check Syzbot reported a KMSAN uninit… |
CVE-2026-43035 | Medium | 5.5 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an i… |
CVE-2026-31693 | High | 7.8 | 2026-04-30 | In the Linux kernel, the following vulnerability has been resolved: cifs: some missing initializations on replay In several places in the code, we have a lab… |
CVE-2026-7141 | Medium | 5.6 | 2026-04-27 | A vulnerability was found in vLLM up to 0.19.0. The affected element is the function has_mamba_layers of the file vllm/v1/kv_cache_interface.py of the componen… |
CVE-2026-31626 | High | 7.1 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() Initialize le_tmp64 to zero i… |
CVE-2026-31621 | Medium | 5.5 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: bnge: return after auxiliary_device_uninit() in error path When auxiliary_device_add() fa… |
CVE-2026-31492 | Medium | 5.5 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Initialize free_qp completion before using it In irdma_create_qp, if ib_copy_… |
CVE-2026-6749 | High | 7.5 | 2026-04-21 | Information disclosure due to uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefo… |
CVE-2026-26175 | Medium | 4.6 | 2026-04-14 | Use of uninitialized resource in Windows Boot Manager allows an unauthorized attacker to bypass a security feature with a physical attack. |
CVE-2026-31428 | Medium | 5.5 | 2026-04-13 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD __build_packet_… |
CVE-2026-31427 | Medium | 5.5 | 2026-04-13 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp process_sdp… |
CVE-2026-34543 | High | 7.5 | 2026-04-01 | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From version 3… |
CVE-2026-27496 | Medium | 6.5 | 2026-03-25 | n8n is an open source workflow automation platform. Prior to versions 1.123.22, 2.9.3, and 2.10.1, an authenticated user with permission to create or modify wo… |
CVE-2026-23358 | Medium | 5.5 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix error handling in slot reset If the device has not recovered after slot r… |
CVE-2026-23317 | High | 7.8 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Return the correct value in vmw_translate_ptr functions Before the referenced… |
CVE-2026-23282 | Medium | 5.5 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix oops due to uninitialised var in smb2_unlink() If SMB2_open_init() or SM… |
CVE-2026-4716 | Critical | 9.1 | 2026-03-24 | Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunder… |
CVE-2026-4715 | Critical | 9.1 | 2026-03-24 | Uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140… |
CVE-2026-4147 | Medium | 6.5 | 2026-03-17 | An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command. |
CVE-2025-12736 | Medium | 6.5 | 2026-03-16 | in OpenHarmony v5.0.3 and prior versions allow a local attacker case sensitive information leak through use of uninitialized resource. |
CVE-2026-3497 | High | 7.5 | 2026-03-12 | Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distrib… |
CVE-2026-2806 | Critical | 9.1 | 2026-02-24 | Uninitialized memory in the Graphics: Text component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
CVE-2026-2794 | High | 7.5 | 2026-02-24 | Information disclosure due to uninitialized memory in Firefox and Firefox Focus for Android. This vulnerability was fixed in Firefox 148. |
CVE-2026-2044 | High | 8.8 | 2026-02-20 | GIMP PGM File Parsing Uninitialized Memory Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affecte… |
CVE-2026-23123 | Medium | 5.5 | 2026-02-14 | In the Linux kernel, the following vulnerability has been resolved: interconnect: debugfs: initialize src_node and dst_node to empty strings The debugfs_crea… |
CVE-2025-12474 | Medium | 4.4 | 2026-02-11 | A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but allocated) memory. This can be done by causing the decoder to r… |
CVE-2026-23101 | Medium | 4.7 | 2026-02-04 | In the Linux kernel, the following vulnerability has been resolved: leds: led-class: Only Add LED to leds_list when it is fully ready Before this change the… |
CVE-2026-24826 | | 2026-01-27 | Out-of-bounds Write, Divide By Zero, NULL Pointer Dereference, Use of Uninitialized Resource, Out-of-bounds Read, Reachable Assertion vulnerability in cadaver… | |
CVE-2026-23007 | Medium | 5.5 | 2026-01-25 | In the Linux kernel, the following vulnerability has been resolved: block: zero non-PI portion of auto integrity buffer The auto-generated integrity buffer f… |
CVE-2026-23003 | High | 7.5 | 2026-01-25 | In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() Blamed commit did not take car… |
CVE-2025-15281 | High | 7.5 | 2026-01-20 | Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialize… |
CVE-2026-0915 | High | 7.5 | 2026-01-15 | Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued netw… |
CVE-2025-71115 | Medium | 5.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: um: init cpu_tasks[] earlier This is currently done in uml_finishsetup(), but e.g. with K… |
CVE-2025-71113 | Medium | 5.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - zero initialize memory allocated via sock_kmalloc Several crypto user AP… |
CVE-2026-20962 | Medium | 4.4 | 2026-01-13 | Use of uninitialized resource in Dynamic Root of Trust for Measurement (DRTM) allows an authorized attacker to disclose information locally. |
CVE-2025-71096 | Medium | 5.5 | 2026-01-13 | In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly The netlink response for… |
CVE-2026-22188 | Medium | 5.5 | 2026-01-07 | The deploy-stub component in Panda3D versions up to and including 1.10.16 contains a denial of service vulnerability due to unbounded stack allocation. The dep… |
CVE-2025-68365 | High | 8.2 | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Initialize allocated memory before use KMSAN reports: Multiple uninitialized va… |
CVE-2025-40829 | High | 7.8 | 2025-12-12 | A vulnerability has been identified in Simcenter Femap (All versions < V2512). The affected applications contains an uninitialized memory vulnerability while p… |