CWE-457 · Memory Corruption
Use of Uninitialized Variable
284CVEs
SortMost likely exploited
284 CVEs with CWE-457 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2009-0901The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 S…Microsoft · Visual C++ · CVSS 8.8 · 2009-07-29 | 8.8 | 37% | 2009-07-29 |
| CVE-2021-40418When parsing a file that is submitted to the DPDecoder service as a job, the R3D SDK will mistakenly skip over the assignment of a property containing an object referring to a UUI…Blackmagicdesign · Blackmagic Design · CVSS 9.8 · 2021-12-22 | 9.8 | 18% | 2021-12-22 |
| CVE-2019-11038Uninitialized read in gdImageCreateFromXbmPHP Group · PHP · CVSS 3.1 · 2019-06-18 | 3.1 | 4.3% | 2019-06-18 |
| CVE-2021-31435This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.931. User interaction is required to exploit this vulner…Foxit · Studio Photo · CVSS 7.8 · 2021-04-29 | 7.8 | 2.8% | 2021-04-29 |
| CVE-2021-46570This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.16.0.80. User interaction is required to exploit this vul…Bentley · View · CVSS 7.8 · 2022-02-18 | 7.8 | 2.1% | 2022-02-18 |
| CVE-2021-46566This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit…Bentley · MicroStation CONNECT · CVSS 7.8 · 2022-02-18 | 7.8 | 2.0% | 2022-02-18 |
| CVE-2021-46631This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerabili…Bentley · View · CVSS 7.8 · 2022-02-18 | 7.8 | 2.0% | 2022-02-18 |
| CVE-2021-46617This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit…Bentley · MicroStation CONNECT · CVSS 7.8 · 2022-02-18 | 7.8 | 2.0% | 2022-02-18 |
| CVE-2011-0539The key_certify function in usr.bin/ssh/key.c in OpenSSH 5.6 and 5.7, when generating legacy certificates using the -t command-line option in ssh-keygen, does not initialize the n…Openbsd · Openssh · CVSS 7.5 · 2011-02-10 | 7.5 | 1.8% | 2011-02-10 |
| CVE-2023-31275An uninitialized pointer use vulnerability exists in the functionality of WPS Office 11.2.0.11537 that handles Data elements in an Excel file. A specially crafted malformed file c…WPS · WPS Office · CVSS 8.8 · 2023-11-27 | 8.8 | 1.7% | 2023-11-27 |
| CVE-2019-1010319WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseWave64Head…WavPack · WavPack · 2019-07-11 | – | 1.5% | 2019-07-11 |
| CVE-2019-1010317WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseCaffHeader…WavPack · WavPack · 2019-07-11 | – | 1.5% | 2019-07-11 |
| CVE-2021-21966An information disclosure vulnerability exists in the HTTP Server /ping.html functionality of Texas Instruments CC3200 SimpleLink Solution NWP 2.9.0.0. A specially-crafted HTTP re…Ti · Texas Instruments · CVSS 5.3 · 2022-02-16 | 5.3 | 1.4% | 2022-02-16 |
| CVE-2022-21217An out-of-bounds write vulnerability exists in the device TestEmail functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted network request can lead to an out-o…Reolink · Rlc-410w Firmware · CVSS 9.1 · 2022-01-28 | 9.1 | 1.2% | 2022-01-28 |
| CVE-2024-21502Versions of the package fastecdsa before 2.3.2 are vulnerable to Use of Uninitialized Variable on the stack, via the curvemath_mul function in src/curveMath.c, due to being used a…Antonkueltz · fastecdsa · CVSS 7.5 · 2024-02-24 | 7.5 | 1.0% | 2024-02-24 |
| CVE-2024-47540GHSL-2024-197: GStreamer uses uninitialized stack memory in Matroska/WebM demuxergstreamer · gstreamer · CVSS 8.6 · 2024-12-11 | 8.6 | 1.0% | 2024-12-11 |
| CVE-2026-10973Uninitialized Use in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)Google · Chrome · CVSS 7.4 · 2026-06-04 | 7.4 | 1.0% | 2026-06-04 |
| CVE-2024-23137Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk · AutoCAD · CVSS 7.8 · 2024-02-22 | 7.8 | 1.0% | 2024-02-22 |
| CVE-2023-31192An information disclosure vulnerability exists in the ClientConnect() functionality of SoftEther VPN 5.01.9674. A specially crafted network packet can lead to a disclosure of sens…SoftEther VPN · SoftEther VPN · CVSS 5.3 · 2023-10-12 | 5.3 | 1.0% | 2023-10-12 |
| CVE-2024-32611HDF5 Library through 1.14.3 may use an uninitialized value in H5A__attr_release_table in H5Aint.c.Hdfgroup · Hdf5 · CVSS 9.8 · 2024-05-09 | 9.8 | 1.0% | 2024-05-09 |
| CVE-2022-28320This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.16.02.022. User interaction is required to exploit this vulnerabi…Bentley · View · CVSS 7.8 · 2023-03-29 | 7.8 | 0.9% | 2023-03-29 |
| CVE-2022-28319This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.034. User interaction is required to exploi…Bentley · MicroStation CONNECT · CVSS 7.8 · 2023-03-29 | 7.8 | 0.9% | 2023-03-29 |
| CVE-2024-26147Helm's Missing YAML Content Leads To Panichelm · helm · CVSS 7.5 · 2024-02-21 | 7.5 | 0.9% | 2024-02-21 |
| CVE-2024-6990Uninitialized Use in Dawn in Google Chrome on Android prior to 127.0.6533.88 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.…Google · Chrome · CVSS 8.8 · 2024-08-01 | 8.8 | 0.9% | 2024-08-01 |
| CVE-2020-27124Cisco Adaptive Security Appliance Software SSL/TLS Denial of Service VulnerabilityCisco · Cisco Adaptive Security Appliance (ASA) Software · CVSS 8.6 · 2024-11-18 | 8.6 | 0.9% | 2024-11-18 |
| CVE-2021-44003A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll is vulnerable to use of uninitial…Siemens · JT2Go · 2021-12-14 | – | 0.8% | 2021-12-14 |
| CVE-2022-34655TMM vulnerability CVE-2022-34655F5 · BIG-IP · CVSS 7.5 · 2022-08-04 | 7.5 | 0.8% | 2022-08-04 |
| CVE-2026-72020ipvs: reset full ip_vs_seq structs in ip_vs_conn_newLinux · Linux · CVSS 9.8 · 2026-08-15 | 9.8 | 0.7% | 2026-08-15 |
| CVE-2023-6324ThroughTek Kalay SDK error in handling the PSK identityThroughTek · Kalay SDK · CVSS 8.1 · 2024-05-15 | 8.1 | 0.7% | 2024-05-15 |
| CVE-2025-20212A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series devices could allow an authenticated, remote attacker to cause a denial of service…Cisco · Cisco Meraki MX Firmware · CVSS 7.7 · 2025-04-02 | 7.7 | 0.7% | 2025-04-02 |
| CVE-2024-26882net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()Linux · Linux · CVSS 7.3 · 2024-04-17 | 7.3 | 0.7% | 2024-04-17 |
| CVE-2022-42432This vulnerability allows local attackers to disclose sensitive information on affected installations of the Linux Kernel 6.0-rc2. An attacker must first obtain the ability to exe…Linux · Kernel · CVSS 5.1 · 2023-03-29 | 5.1 | 0.7% | 2023-03-29 |
| CVE-2025-54874OpenJPEG allows OOB heap memory write in opj_jp2_read_headeruclouvain · openjpeg · CVSS 6.6 · 2025-08-05 | 6.6 | 0.7% | 2025-08-05 |
| CVE-2021-3928Use of Uninitialized Variable in vim/vimvim · vim/vim · CVSS 7.3 · 2021-11-05 | 7.3 | 0.6% | 2021-11-05 |
| CVE-2022-28317This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit…Bentley · MicroStation CONNECT · CVSS 7.8 · 2023-03-29 | 7.8 | 0.6% | 2023-03-29 |
| CVE-2025-58466QTS, QuTS heroQNAP Systems Inc. · QTS · CVSS 1.2 · 2026-02-11 | 1.2 | 0.6% | 2026-02-11 |
| CVE-2026-91963FreeRDP 2.0.0 through 3.30.0 Uninitialized Heap Memory Disclosure via urbdrcFreeRDP · FreeRDP · CVSS 6.5 · 2026-09-15 | 6.5 | 0.6% | 2026-09-15 |
| CVE-2026-121611Gstreamer1-plugins-bad-free: gst-plugins-bad: use of uninitialized gsth265hrdparams in gst_h265_parse_vps() multi-hrd workaround loopRed Hat · Red Hat Enterprise Linux 10 · CVSS 6.5 · 2026-11-09 | 6.5 | 0.6% | 2026-11-09 |
| CVE-2026-112893Pillow: Invalid free in FreeType glyph rendering when a stroker is activepython-pillow · Pillow · CVSS 8.2 · 2026-10-19 | 8.2 | 0.5% | 2026-10-19 |
| CVE-2026-23003ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()Linux · Linux · CVSS 7.5 · 2026-01-25 | 7.5 | 0.5% | 2026-01-25 |
| CVE-2025-20271Cisco Meraki MX and Z Series AnyConnect VPN with Client Certificate Authentication Denial of Service VulnerabilityCisco · Cisco Meraki MX Firmware · CVSS 8.6 · 2025-06-18 | 8.6 | 0.5% | 2025-06-18 |
| CVE-2024-29838Unsanitised variable on DAL_ADD in Evolution Controller causes application level denial of service and crashCS Technologies Australia · Evolution Controller · CVSS 7.5 · 2024-04-14 | 7.5 | 0.5% | 2024-04-14 |
| CVE-2026-17714Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML pag…Google · Chrome · CVSS 6.5 · 2026-07-30 | 6.5 | 0.5% | 2026-07-30 |
| CVE-2026-17668Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)Google · Chrome · CVSS 6.5 · 2026-07-30 | 6.5 | 0.5% | 2026-07-30 |
| CVE-2026-17667Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)Google · Chrome · CVSS 6.5 · 2026-07-30 | 6.5 | 0.5% | 2026-07-30 |
| CVE-2026-78935Use of uninitialized variable in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a…Google · Chrome · CVSS 9.6 · 2026-08-25 | 9.6 | 0.5% | 2026-08-25 |
| CVE-2026-14405Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security se…Google · Chrome · CVSS 9.6 · 2026-07-01 | 9.6 | 0.5% | 2026-07-01 |
| CVE-2026-52931batman-adv: tp_meter: avoid use of uninit sender varsLinux · Linux · CVSS 9.8 · 2026-06-24 | 9.8 | 0.5% | 2026-06-24 |
| CVE-2025-40575A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices do not properly validate incoming Profinet packets. An una…Siemens · SCALANCE LPE9403 · CVSS 4.3 · 2025-05-13 | 4.3 | 0.5% | 2025-05-13 |
| CVE-2026-17077IBM i is Affected By Multiple Vulnerabilities in DRDA / DDMIBM · i · CVSS 5.3 · 2026-08-13 | 5.3 | 0.5% | 2026-08-13 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.