CWE-908 · Memory Corruption
Use of Uninitialized Resource
931CVEs
2exploited
1with a public check
32likely (EPSS 10%+)
SortMost likely exploited
931 CVEs with CWE-908 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-50302In CISA KEVExploitedHID: core: zero-initialize the report bufferLinux · Linux · CVSS 5.5 · 2024-11-19 | 5.5 | 0.8% | 2024-11-19 |
| CVE-2024-29745In CISA KEVExploitedthere is a possible Information Disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interact…Google · Android · CVSS 5.5 · 2024-04-05 | 5.5 | 0.5% | 2024-04-05 |
| CVE-2023-22897CheckSecurepoint UTM - Leaking Remote Memory ContentsSecurepoint · Unified Threat Management · CVSS 6.5 · 2023-04-12 | 6.5 | 4.1% | 2023-04-12 |
| CVE-2023-24941Windows Network File System Remote Code Execution VulnerabilityMicrosoft · Windows Server 2019 · CVSS 9.8 · 2023-05-09 | 9.8 | 95% | 2023-05-09 |
| CVE-2007-1751Microsoft Internet Explorer 5.01, 6, and 7 allows remote attackers to execute arbitrary code by causing Internet Explorer to access an uninitialized or deleted object, related to…Microsoft · Internet Explorer · 2007-06-12 | – | 61% | 2007-06-12 |
| CVE-2008-0081Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, and Office 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via cr…Microsoft · Excel · CVSS 9.8 · 2008-01-16 | 9.8 | 58% | 2008-01-16 |
| CVE-2020-1934In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server.Apache · Apache HTTP Server · 2020-04-01 | – | 52% | 2020-04-01 |
| CVE-2011-1255The Timed Interactive Multimedia Extensions (aka HTML+TIME) implementation in Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remo…Microsoft · Internet Explorer · 2011-06-16 | – | 42% | 2011-06-16 |
| CVE-2008-3475Microsoft Internet Explorer 6 does not properly handle errors related to using the componentFromPoint method on xml objects that have been (1) incorrectly initialized or (2) delet…Microsoft · Internet Explorer · 2008-10-15 | – | 40% | 2008-10-15 |
| CVE-2012-1891Heap-based buffer overflow in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2 and Windows Data Access Components (WDAC) 6.0 allows remote attackers to execute arbitrary co…Microsoft · Data Access Components · CVSS 9.8 · 2012-07-10 | 9.8 | 29% | 2012-07-10 |
| CVE-2011-1995Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that was not pro…Microsoft · Internet Explorer · 2011-10-12 | – | 29% | 2011-10-12 |
| CVE-2009-1529Microsoft Internet Explorer 7 for Windows XP SP2 and SP3; 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 does not properly handle objects in memo…Microsoft · Internet Explorer · CVSS 8.1 · 2009-06-10 | 8.1 | 29% | 2009-06-10 |
| CVE-2010-3346Microsoft Internet Explorer 6, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not…Microsoft · Internet Explorer · 2010-12-16 | – | 28% | 2010-12-16 |
| CVE-2010-3345Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly…Microsoft · Internet Explorer · 2010-12-16 | – | 28% | 2010-12-16 |
| CVE-2010-3343Microsoft Internet Explorer 6 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly…Microsoft · Internet Explorer · 2010-12-16 | – | 28% | 2010-12-16 |
| CVE-2010-2559Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly…Microsoft · Internet Explorer · 2010-08-11 | – | 28% | 2010-08-11 |
| CVE-2010-2557Microsoft Internet Explorer 6 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly…Microsoft · Internet Explorer · 2010-08-11 | – | 28% | 2010-08-11 |
| CVE-2010-2556Microsoft Internet Explorer 6, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not…Microsoft · Internet Explorer · 2010-08-11 | – | 28% | 2010-08-11 |
| CVE-2011-1964Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not…Microsoft · Internet Explorer · 2011-08-10 | – | 23% | 2011-08-10 |
| CVE-2011-1963Microsoft Internet Explorer 7 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not…Microsoft · Internet Explorer · 2011-08-10 | – | 23% | 2011-08-10 |
| CVE-2011-1261Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not…Microsoft · Internet Explorer · 2011-06-16 | – | 22% | 2011-06-16 |
| CVE-2011-1250Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not…Microsoft · Internet Explorer · 2011-06-16 | – | 22% | 2011-06-16 |
| CVE-2011-1998Microsoft Internet Explorer 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that was not properly init…Microsoft · Internet Explorer · 2011-10-12 | – | 21% | 2011-10-12 |
| CVE-2009-0949The ippReadIO function in cups/ipp.c in cupsd in CUPS before 1.3.10 does not properly initialize memory for IPP request packets, which allows remote attackers to cause a denial of…Apple · Cups · 2009-06-09 | – | 20% | 2009-06-09 |
| CVE-2011-1256Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not…Microsoft · Internet Explorer · 2011-06-16 | – | 19% | 2011-06-16 |
| CVE-2011-1266The Vector Markup Language (VML) implementation in vgx.dll in Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to…Microsoft · Internet Explorer · 2011-06-16 | – | 18% | 2011-06-16 |
| CVE-2011-1254Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not…Microsoft · Internet Explorer · 2011-06-16 | – | 18% | 2011-06-16 |
| CVE-2011-1251Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly…Microsoft · Internet Explorer · 2011-06-16 | – | 18% | 2011-06-16 |
| CVE-2019-1462A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory, aka 'Microsoft PowerPoint Remote Code E…Microsoft · Microsoft Office · 2019-12-10 | – | 18% | 2019-12-10 |
| CVE-2011-1262Microsoft Internet Explorer 7 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not…Microsoft · Internet Explorer · 2011-06-16 | – | 17% | 2011-06-16 |
| CVE-2024-26209Microsoft Local Security Authority Subsystem Service Information Disclosure VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 5.5 · 2024-04-09 | 5.5 | 15% | 2024-04-09 |
| CVE-2009-2692The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops structures, which allows local us…Linux · Linux Kernel · 2009-08-14 | – | 15% | 2009-08-14 |
| CVE-2015-5165The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows remote attackers to read process heap memory via unspecifi…Xen · Xen · 2015-08-12 | – | 13% | 2015-08-12 |
| CVE-2020-1206An information disclosure vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server…Microsoft · Windows 10 Version 1909 for 32-bit Systems · 2020-06-09 | – | 11% | 2020-06-09 |
| CVE-2025-33070Windows Netlogon Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 8.1 · 2025-06-10 | 8.1 | 10% | 2025-06-10 |
| CVE-2019-9641An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_TIFF.Php · Php · 2019-03-08 | – | 9.4% | 2019-03-08 |
| CVE-2024-12085Rsync: info leak via uninitialized stack contentsRedhat · rsync · CVSS 7.5 · 2025-01-14 | 7.5 | 8.6% | 2025-01-14 |
| CVE-2018-8627An information disclosure vulnerability exists when Microsoft Excel software reads out of bound memory due to an uninitialized variable, which could disclose the contents of memor…Microsoft · Microsoft Office · 2018-12-12 | – | 8.6% | 2018-12-12 |
| CVE-2019-9639An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE be…Php · Php · 2019-03-08 | – | 8.2% | 2019-03-08 |
| CVE-2023-36713Windows Common Log File System Driver Information Disclosure VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 5.5 · 2023-10-10 | 5.5 | 6.8% | 2023-10-10 |
| CVE-2019-13117In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to disc…Xmlsoft · Libxslt · CVSS 5.3 · 2019-07-01 | 5.3 | 6.5% | 2019-07-01 |
| CVE-2008-4197Opera before 9.52 on Windows, Linux, FreeBSD, and Solaris, when processing custom shortcut and menu commands, can produce argument strings that contain uninitialized memory, which…Opera · Opera Browser · 2008-09-27 | – | 6.3% | 2008-09-27 |
| CVE-2024-43502Windows Kernel Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 7.1 · 2024-10-08 | 7.1 | 6.3% | 2024-10-08 |
| CVE-2018-1037An information disclosure vulnerability exists when Visual Studio improperly discloses limited contents of uninitialized memory while compiling program database (PDB) files, aka "…Microsoft · Microsoft Visual Studio · 2018-04-12 | – | 5.8% | 2018-04-12 |
| CVE-2019-0006Junos OS: EX, QFX and MX series: Packet Forwarding Engine manager (FXPC) process crashes due to a crafted HTTP packet in a Virtual Chassis configurationJuniper Networks · Junos OS · CVSS 9.8 · 2019-01-15 | 9.8 | 5.3% | 2019-01-15 |
| CVE-2020-16932Microsoft Excel Remote Code Execution VulnerabilityMicrosoft · Microsoft Office 2019 · CVSS 7.8 · 2020-10-16 | 7.8 | 4.8% | 2020-10-16 |
| CVE-2020-16931Microsoft Excel Remote Code Execution VulnerabilityMicrosoft · Microsoft Office 2019 · CVSS 7.8 · 2020-10-16 | 7.8 | 4.8% | 2020-10-16 |
| CVE-2015-8390PCRE before 8.38 mishandles the [: and \\ substrings in character classes, which allows remote attackers to cause a denial of service (uninitialized memory read) or possibly have…Pcre · Perl Compatible Regular Expression Library · 2015-12-02 | – | 4.7% | 2015-12-02 |
| CVE-2024-38257Microsoft AllJoyn API Information Disclosure VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 7.5 · 2024-09-10 | 7.5 | 4.5% | 2024-09-10 |
| CVE-2018-10115Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memory, allowing remote attackers to cause a denial of service (…7-Zip · 7-Zip · 2018-05-02 | – | 4.3% | 2018-05-02 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.