CWE-909 · Memory Corruption
Missing Initialization of Resource
81CVEs
SortMost likely exploited
81 CVEs with CWE-909 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2018-10811strongSwan 5.6.0 and older allows Remote Denial of Service because of Missing Initialization of a Variable.Strongswan · Strongswan · 2018-06-19 | – | 6.2% | 2018-06-19 |
| CVE-2020-12352Improper access control in BlueZ may allow an unauthenticated user to potentially enable information disclosure via adjacent access.Linux · BlueZ · 2020-11-23 | – | 5.8% | 2020-11-23 |
| CVE-2019-3804It was found that cockpit before version 184 used glib's base64 decode functionality incorrectly resulting in a denial of service attack. An unauthenticated attacker could send a…Cockpit-Project · cockpit · CVSS 7.5 · 2019-03-26 | 7.5 | 4.9% | 2019-03-26 |
| CVE-2019-12410While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when r…Apache Software Foundation · Apache Arrow · 2019-11-08 | – | 4.6% | 2019-11-08 |
| CVE-2019-19553In Wireshark 3.0.0 to 3.0.6 and 2.6.0 to 2.6.12, the CMS dissector could crash. This was addressed in epan/dissectors/asn1/cms/packet-cms-template.c by ensuring that an object ide…Wireshark · Wireshark · 2019-12-05 | – | 4.1% | 2019-12-05 |
| CVE-2019-12408It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized memory bug when buildin…Apache Software Foundation · Apache Arrow · 2019-11-08 | – | 3.2% | 2019-11-08 |
| CVE-2019-16714In the Linux kernel before 5.2.14, rds6_inc_info_copy in net/rds/recv.c allows attackers to obtain sensitive information from kernel stack memory because tos and flags fields are…Linux · Linux Kernel · 2019-09-23 | – | 2.7% | 2019-09-23 |
| CVE-2021-36386report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mail servers to cause a denial of service…Fetchmail · Fetchmail · 2021-07-29 | – | 2.6% | 2021-07-29 |
| CVE-2018-21247An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function.Libvnc Project · Libvncserver · 2020-06-17 | – | 2.4% | 2020-06-17 |
| CVE-2021-36513An issue was discovered in function sofia_handle_sip_i_notify in sofia.c in SignalWire freeswitch before 1.10.6, may allow attackers to view sensitive information due to an uninit…Signalwire · Freeswitch · 2021-10-18 | – | 1.9% | 2021-10-18 |
| CVE-2020-20739im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path or stack address.Libvips · Libvips · 2020-11-20 | – | 1.8% | 2020-11-20 |
| CVE-2021-23994A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10…Mozilla · Firefox ESR · 2021-06-24 | – | 1.8% | 2021-06-24 |
| CVE-2021-23386Remote Memory ExposureDns-Packet Project · dns-packet · CVSS 7.7 · 2021-05-20 | 7.7 | 1.4% | 2021-05-20 |
| CVE-2021-29980Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderb…Mozilla · Thunderbird · 2021-08-17 | – | 1.4% | 2021-08-17 |
| CVE-2020-1419An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address, aka 'Windows Kernel Information Disclosure Vulnerability'. Th…Microsoft · Windows 10 Version 2004 for 32-bit Systems · 2020-07-14 | – | 1.4% | 2020-07-14 |
| CVE-2022-22704The zabbix-agent2 package before 5.4.9-r1 for Alpine Linux sometimes allows privilege escalation to root because the design incorrectly expected that systemd would (in effect) det…Zabbix · Zabbix-Agent2 · 2022-01-06 | – | 1.4% | 2022-01-06 |
| CVE-2021-28167In Eclipse Openj9 to version 0.25.0, usage of the jdk.internal.reflect.ConstantPool API causes the JVM in some cases to pre-resolve certain constant pool entries. This allows a us…The Eclipse Foundation · Eclipse OpenJ9 · 2021-04-21 | – | 1.1% | 2021-04-21 |
| CVE-2020-25579In FreeBSD 12.2-STABLE before r368969, 11.4-STABLE before r369047, 12.2-RELEASE before p3, 12.1-RELEASE before p13 and 11.4-RELEASE before p7 msdosfs(5) was failing to zero-fill a…Freebsd · FreeBSD · 2021-03-26 | – | 1.1% | 2021-03-26 |
| CVE-2021-31919An issue was discovered in the rkyv crate before 0.6.0 for Rust. When an archive is created via serialization, the archive content may contain uninitialized values of certain part…Rkyv Project · Rkyv · 2021-04-30 | – | 1.1% | 2021-04-30 |
| CVE-2022-29968An issue was discovered in the Linux kernel through 5.17.5. io_rw_init_file in fs/io_uring.c lacks initialization of kiocb->private.Linux · Linux Kernel · 2022-05-02 | – | 1.1% | 2022-05-02 |
| CVE-2019-25054An issue was discovered in the pnet crate before 0.27.2 for Rust. There is a segmentation fault (upon attempted dereference of an uninitialized descriptor) because of an erroneous…Pnet Project · Pnet · 2021-12-26 | – | 1.0% | 2021-12-26 |
| CVE-2020-12523Phoenix Contact mGuard Devices versions before 8.8.3: LAN ports get functional after reboot even if they are disabled in the device configurationPhoenix Contact · TC MGUARD RS4000 4G VZW VPN (1010461) · CVSS 5.4 · 2020-12-17 | 5.4 | 0.9% | 2020-12-17 |
| CVE-2019-9321In libavc, there is a missing variable initialization. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed…Google · Android · 2019-09-27 | – | 0.7% | 2019-09-27 |
| CVE-2019-9320In libavc, there is a missing variable initialization. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed…Google · Android · 2019-09-27 | – | 0.7% | 2019-09-27 |
| CVE-2019-9319In libavc, there is a missing variable initialization. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed…Google · Android · 2019-09-27 | – | 0.7% | 2019-09-27 |
| CVE-2019-9318In libhevc, there is a missing variable initialization. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed…Google · Android · 2019-09-27 | – | 0.7% | 2019-09-27 |
| CVE-2019-9317In libstagefright, there is a missing variable initialization. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is…Google · Android · 2019-09-27 | – | 0.7% | 2019-09-27 |
| CVE-2019-9316In libstagefright, there is a missing variable initialization. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is…Google · Android · 2019-09-27 | – | 0.7% | 2019-09-27 |
| CVE-2019-9315In libhevc, there is a missing variable initialization. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed…Google · Android · 2019-09-27 | – | 0.7% | 2019-09-27 |
| CVE-2019-9314In libavc, there is a missing variable initialization. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed…Google · Android · 2019-09-27 | – | 0.7% | 2019-09-27 |
| CVE-2019-9313In libstagefright, there is a missing variable initialization. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is…Google · Android · 2019-09-27 | – | 0.7% | 2019-09-27 |
| CVE-2019-9247In AAC Codec, there is a missing variable initialization. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is need…Google · Android · 2019-09-27 | – | 0.7% | 2019-09-27 |
| CVE-2021-39966There is an Uninitialized AOD driver structure in Smartphones.Successful exploitation of this vulnerability may affect service confidentiality.Huawei · EMUI · 2022-01-03 | – | 0.7% | 2022-01-03 |
| CVE-2024-50076vt: prevent kernel-infoleak in con_font_get()Linux · Linux · 2024-10-29 | – | 0.6% | 2024-10-29 |
| CVE-2020-24455Missing initialization of a variable in the TPM2 source may allow a privileged user to potentially enable an escalation of privilege via local access. This affects tpm2-tss before…Tpm2 Software Stack Project · TPM2 source · 2021-02-26 | – | 0.6% | 2021-02-26 |
| CVE-2019-19534In the Linux kernel before 5.3.11, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_core.c driver, aka CID-f7a13…Linux · Linux Kernel · 2019-12-03 | – | 0.5% | 2019-12-03 |
| CVE-2021-22482There is an Uninitialized variable vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause transmission of invalid data.Huawei · EMUI · 2021-10-28 | – | 0.5% | 2021-10-28 |
| CVE-2026-113351libexpat 2.7.2 through 2.9.0 Denial of Service via XML_ParserResetlibexpat · libexpat · CVSS 5.9 · 2026-10-20 | 5.9 | 0.5% | 2026-10-20 |
| CVE-2021-34693net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized.Linux · Linux Kernel · 2021-06-14 | – | 0.5% | 2021-06-14 |
| CVE-2020-9227Huawei Smart Phones Moana-AL00B with versions earlier than 10.1.0.166 have a missing initialization of resource vulnerability. An attacker tricks the user into installing then run…Huawei · Moana-AL00B · 2020-07-17 | – | 0.5% | 2020-07-17 |
| CVE-2020-11741An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (with active profiling) to obtain sensitive information about other guests, cause a denial of se…Xen · Xen · 2020-04-14 | – | 0.4% | 2020-04-14 |
| CVE-2010-3297The eql_g_master_cfg function in drivers/net/eql.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure member, which allows local users to obtai…Linux · Linux Kernel · 2010-09-30 | – | 0.4% | 2010-09-30 |
| CVE-2009-3228The tc_fill_tclass function in net/sched/sch_api.c in the tc subsystem in the Linux kernel 2.4.x before 2.4.37.6 and 2.6.x before 2.6.31-rc9 does not initialize certain (1) tcm__p…Linux · Linux Kernel · 2009-10-19 | – | 0.4% | 2009-10-19 |
| CVE-2010-4081The snd_hdspm_hwdep_ioctl function in sound/pci/rme9652/hdspm.c in the Linux kernel before 2.6.36-rc6 does not initialize a certain structure, which allows local users to obtain p…Linux · Linux Kernel · 2010-11-30 | – | 0.4% | 2010-11-30 |
| CVE-2010-4083The copy_semid_to_user function in ipc/sem.c in the Linux kernel before 2.6.36 does not initialize a certain structure, which allows local users to obtain potentially sensitive in…Linux · Linux Kernel · 2010-11-30 | – | 0.4% | 2010-11-30 |
| CVE-2010-3877The get_name function in net/tipc/socket.c in the Linux kernel before 2.6.37-rc2 does not initialize a certain structure, which allows local users to obtain potentially sensitive…Linux · Linux Kernel · 2011-01-03 | – | 0.4% | 2011-01-03 |
| CVE-2011-1044The ib_uverbs_poll_cq function in drivers/infiniband/core/uverbs_cmd.c in the Linux kernel before 2.6.37 does not initialize a certain response buffer, which allows local users to…Linux · Linux Kernel · 2011-02-18 | – | 0.4% | 2011-02-18 |
| CVE-2022-0382An information leak flaw was found due to uninitialized memory in the Linux kernel's TIPC protocol subsystem, in the way a user sends a TIPC datagram to one or more destinations.…Linux · kernel · 2022-02-11 | – | 0.4% | 2022-02-11 |
| CVE-2010-4082The viafb_ioctl_get_viafb_info function in drivers/video/via/ioctl.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure member, which allows lo…Linux · Linux Kernel · 2010-11-30 | – | 0.4% | 2010-11-30 |
| CVE-2010-4078The sisfb_ioctl function in drivers/video/sis/sis_main.c in the Linux kernel before 2.6.36-rc6 does not properly initialize a certain structure member, which allows local users to…Linux · Linux Kernel · 2010-11-29 | – | 0.4% | 2010-11-29 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.