Skip to content
BackEsc
Sign in

CWE-824 · weakness in Memory Corruption

Access of Uninitialized Pointer

285 CVEs · 2 exploited

Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

exploited in the wild
2
check available
1
likely to be exploited
8

Every one of the 285 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. Windows Runtime Remote Code Execution VulnerabilityCVE-2022-21971Microsoft · CVSS 7.8 · 54% likely

    Microsoft

  2. Microsoft Office 2013 SP1 and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Uninitialized Memory Use Vulnerabi…CVE-2015-1770Microsoft · CVSS 8.8 · 35% likely

    Microsoft

  3. Pure-FTPd ≤ 1.0.49 - DoS via Uninitialized PointerCVE-2020-92746.0% likely
  4. This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this…CVE-2018-9948Foxit · 62% likely

    Foxit

  5. Subversion's mod_dav_svn Apache HTTPD module versions 1.11.0 and 1.10.0 to 1.10.3 will crash after dereferencing an uninitialized pointer if the client omits the root path in a re…CVE-2018-11803Apache Software Foundation · 58% likely

    Apache

  6. The IPersistPropertyBag2::Read function in QTPlugin.ocx in Apple QuickTime 6.x, 7.x before 7.6.8, and other versions allows remote attackers to execute arbitrary code via the _Mar…CVE-2010-181843% likely
  7. A remote code execution vulnerability in HPE intelligent Management Center (iMC) PLAT version Plat 7.3 E0504P4 and earlier was found.CVE-2017-12561Hewlett Packard Enterprise · 31% likely

    Hewlett Packard Enterprise

  8. A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vulnerabili…CVE-2019-0853Microsoft · 30% likely

    Microsoft

  9. Adobe Acrobat Reader DC Font Parsing Uninitialized Variable Remote Code Execution VulnerabilityCVE-2022-27794Adobe · CVSS 7.8 · 14% likely

    Adobe

  10. The gssrpc__svcauth_gssapi function in the RPC library in MIT Kerberos 5 (krb5) 1.6.1 and earlier might allow remote attackers to execute arbitrary code via a zero-length RPC cred…CVE-2007-244211% likely
  11. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.916. User interaction is required to exploit this vulner…CVE-2020-8882Foxit · CVSS 7.8 · 11% likely

    Foxit

  12. The asn1_decode_generaltime function in lib/krb5/asn.1/asn1_decode.c in the ASN.1 GeneralizedTime decoder in MIT Kerberos 5 (aka krb5) before 1.6.4 allows remote attackers to caus…CVE-2009-08468.9% likely
  13. The RPC library in Kerberos 5 1.4 through 1.4.4, and 1.5 through 1.5.1, as used in Kerberos administration daemon (kadmind) and other products that use this library, calls an unin…CVE-2006-61438.2% likely
  14. A use-of-uninitialized-pointer vulnerability exists in the Forward Open connection_management_entry functionality of EIP Stack Group OpENer development commit 58ee13c. A specially…CVE-2022-43606EIP Stack Group · CVSS 7.5 · 8.0% likely
  15. lib/pk-libgcrypt.c in libgnutls in GnuTLS before 2.6.6 does not properly handle invalid DSA signatures, which allows remote attackers to cause a denial of service (application cra…CVE-2009-14157.9% likely
  16. An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and…CVE-2017-16378Adobe Acrobat Reader 2017.012.20098 and earlier versions, 2017.011.30066 and ea… · 6.8% likely
  17. An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and…CVE-2017-16377Adobe Acrobat Reader 2017.012.20098 and earlier versions, 2017.011.30066 and ea… · 6.8% likely
  18. Santesoft Sante PACS Server Access of Uninitialized Pointer DoSCVE-2025-2284Santesoft · CVSS 7.5 · 6.3% likely

    Santesoft

  19. The kadm5_modify_policy_internal function in lib/kadm5/srv/svr_policy.c in the Kerberos administration daemon (kadmind) in MIT Kerberos 5 (krb5) 1.5 through 1.6.2 does not properl…CVE-2007-40006.1% likely
  20. Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 do not properly initialize memory for GIF rendering, which allows remote attackers to o…CVE-2014-15645.5% likely
  21. In Rockwell Automation Arena Simulation Software Cat. 9502-Ax, Versions 16.00.00 and earlier, a maliciously crafted Arena file opened by an unsuspecting user may result in the use…CVE-2019-13527Rockwell Automation Arena Simulation Software Cat. 9502-Ax, Versions 16.00.00 a… · 5.3% likely
  22. Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK befor…CVE-2016-10055.3% likely
  23. EnterpriseDB Advanced Server 8.2 does not properly handle certain debugging function calls that occur before a call to pldbg_create_listener, which allows remote authenticated use…CVE-2007-46395.1% likely
  24. The PNG reference library (aka libpng) before 1.0.43, and 1.2.x before 1.2.35, as used in pngcrush and other applications, allows context-dependent attackers to cause a denial of…CVE-2009-00404.8% likely
  25. The decompression implementation in the Imf::hufUncompress function in OpenEXR 1.2.2 and 1.6.1 allows context-dependent attackers to cause a denial of service (application crash)…CVE-2009-17214.3% likely
  26. The phar_make_dirstream function in ext/phar/dirstream.c in PHP before 5.6.18 and 7.x before 7.0.3 mishandles zero-size ././@LongLink files, which allows remote attackers to cause…CVE-2016-43434.2% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in