CVE-2024-29745
there is a possible Information Disclosure due to uninitialized data.
Medium
Known exploited
- Severity
- 5.5 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.49%
- Chance of exploitation in the next 30 days. Higher than 41.90% of scored vulnerabilities.
- Known exploited
- Yes
- In CISA's catalog since Apr 4, 2024
- Fix
- None yet
- No fixed version published
Exploited in the wild. Android Pixel Information Disclosure Vulnerability (Android Pixel). Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Due for U.S. federal agencies by Apr 25, 2024.
Description
there is a possible Information Disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-908: Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
How to prevent it
- Implementation: Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps.
- Implementation: Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.
- Implementation: Avoid race conditions (CWE-362) during initialization routines.
- Build and Compilation: Run or compile the product with settings that generate warnings about uninitialized variables or data.
CWE-908: Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
How to prevent it
- Implementation: Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps.
- Implementation: Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.
- Implementation: Avoid race conditions (CWE-362) during initialization routines.
- Build and Compilation: Run or compile the product with settings that generate warnings about uninitialized variables or data.
References
Advisories
Other links
Timeline
- Added to CISA's Known Exploited Vulnerabilities catalog
- Published
- Remediation due for U.S. federal agencies
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-654x-cwwv-5j9c Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1 | Medium | Same weakness, CWE-908 |
| GHSA-q45j-58j2-45rg Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips | Medium | Same weakness, CWE-908 |
| RUSTSEC-2026-0323 fd_readdir copies uninitialized struct padding into guest memory | Low | Same weakness, CWE-908 |
| CVE-2026-85880 Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally. | High Known exploited | Same weakness, CWE-908 |
| GHSA-8g53-9m3c-69xg ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged | Medium | Same weakness, CWE-908 |
| GHSA-fm7p-mprw-wjm9 Oj: intern.c form_attr (uninitialized stack read) | Medium | Same weakness, CWE-908 |
| GHSA-58qx-3vcg-4xpx ws: Uninitialized memory disclosure | High | Same weakness, CWE-908 |
| GHSA-x368-4g9h-fvv4 vLLM makes Use of Uninitialized Resource | Medium | Same weakness, CWE-908 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor