CWE-908
CVEs classified under CWE-908, newest first.
322 CVEsRSS
CVE-2026-104086Medium· 5.57-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 archive handler (SquashfsHandler.cpp) that allows attackers to leak heap memory by crafting a malicious archive where the superblock’s no_ids…
7-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 archive handler (SquashfsHandler.cpp) that allows attackers to leak heap memory by crafting a malicious archive where the superblock’s no_ids…
CVE-2026-97011High· 8.8Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-96850Medium· 5.5Use of uninitialized resource in Windows Modern Device Management (MDM) allows an authorized attacker to disclose information locally.
Use of uninitialized resource in Windows Modern Device Management (MDM) allows an authorized attacker to disclose information locally.
CVE-2026-96849Medium· 5.5Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally.
Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally.
CVE-2026-96247Medium· 5.5Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally.
Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally.
CVE-2026-96206Medium· 6.5Use of uninitialized resource in Windows Subsystem for Linux allows an authorized attacker to disclose information locally.
Use of uninitialized resource in Windows Subsystem for Linux allows an authorized attacker to disclose information locally.
CVE-2026-88150High· 8.8Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-85843High· 7.8Use of uninitialized resource in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.
Use of uninitialized resource in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.
CVE-2026-85322High· 7.5Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
CVE-2026-85320Medium· 5.5Use of uninitialized resource in Windows Print Spooler Components allows an authorized attacker to disclose information locally.
Use of uninitialized resource in Windows Print Spooler Components allows an authorized attacker to disclose information locally.
CVE-2026-83925Medium· 4.7Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally.
Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally.
CVE-2026-83755Medium· 5.5Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally.
Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally.
CVE-2026-83723Medium· 5.5Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally.
Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally.
CVE-2026-83714Medium· 5.5Use of uninitialized resource in Windows HTTP.sys allows an authorized attacker to disclose information locally.
Use of uninitialized resource in Windows HTTP.sys allows an authorized attacker to disclose information locally.
CVE-2026-83695Medium· 5.5Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally.
Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally.
CVE-2026-83669High· 7.8Use of uninitialized resource in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
Use of uninitialized resource in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
CVE-2026-83515Medium· 6.5Use of uninitialized resource in RPC Runtime allows an unauthorized attacker to disclose information over a network.
Use of uninitialized resource in RPC Runtime allows an unauthorized attacker to disclose information over a network.
CVE-2026-70293Medium· 5.5Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
CVE-2026-70284Medium· 5.5Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
CVE-2026-70090Medium· 5.5Use of uninitialized resource in Windows Netlogon allows an authorized attacker to disclose information locally.
Use of uninitialized resource in Windows Netlogon allows an authorized attacker to disclose information locally.
CVE-2026-105731Medium· 5.5Use of uninitialized resource in Microsoft Graphics Component allows an authorized attacker to disclose information locally.
Use of uninitialized resource in Microsoft Graphics Component allows an authorized attacker to disclose information locally.
CVE-2026-102187Medium· 5.5Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally.
Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally.
CVE-2026-109828Medium· 4.3PoCA vulnerability was found in libsndfile up to 1.2.2
A vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlike_subchunk_parse of the file src/wavlike.c of the component WAV Parsing. Performing a manipulation results in use of uninitialized variable. Remot…
CVE-2026-109712High· 7.1Sandbox escape due to uninitialized memory in the Graphics component
Sandbox escape due to uninitialized memory in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVE-2026-109273Medium· 5.3ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the PostScript decoder, which allocates a buffer one byte longer than the data it decoded
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the PostScript decoder, which allocates a buffer one byte longer than the data it decoded. Attackers can supply a crafted PostScript…
CVE-2026-109242High· 7.1PoCFreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile->current buffer is allocated without zeroing
FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile->current buffer is allocated without zeroing. A malicious RDP server can send a crafted WBT_TILE_FIRST then…
CVE-2026-107676Low· 3.3FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 Bl…
CVE-2026-104074Medium· 5.3Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credentials
Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credentials. Attackers can exploit the stun_ini…
CVE-2026-106245Medium· 4.3⚖ disputedUninitialized resource in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page
Uninitialized resource in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106376Medium· 4.7⚖ disputedUninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)