Skip to content
Log inStart free trial

CWE-908: Use of Uninitialized Resource

BaseLikelihood of exploit: Medium

The product uses or accesses a resource that has not been initialized.

When a resource has not been properly initialized, the product may behave unexpectedly. This may lead to a crash or invalid memory access, but the consequences vary depending on the type of resource and how it is used within the product.

Consequences

  • Confidentiality: Read Memory, Read Application Data
  • Availability: DoS: Crash, Exit, or Restart

How to prevent it

  • Implementation: Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps.
  • Implementation: Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.
  • Implementation: Avoid race conditions (CWE-362) during initialization routines.
  • Build and Compilation: Run or compile the product with settings that generate warnings about uninitialized variables or data.

Recent advisories

  • GHSA-654x-cwwv-5j9c — Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1
  • GHSA-q45j-58j2-45rg — Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
  • RUSTSEC-2026-0323 — fd_readdir copies uninitialized struct padding into guest memory
  • CVE-2026-85880 — Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.
  • GHSA-8g53-9m3c-69xg — ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged
  • GHSA-fm7p-mprw-wjm9 — Oj: intern.c form_attr (uninitialized stack read)
  • GHSA-58qx-3vcg-4xpx — ws: Uninitialized memory disclosure
  • GHSA-x368-4g9h-fvv4 — vLLM makes Use of Uninitialized Resource
  • GHSA-xvh5-5qg4-x9qp — n8n has In-Process Memory Disclosure in its Task Runner
  • GHSA-f9f8-9pmf-xv68 — Helm May Panic Due To Incorrect YAML Content
  • CVE-2025-5777 — Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA…
  • GHSA-2cj2-qqxj-5m3r — Phusion Passenger denial of service
  • CVE-2024-50302 — HID: core: zero-initialize the report buffer
  • CVE-2024-29745 — there is a possible Information Disclosure due to uninitialized data.
  • GHSA-r53h-jv2g-vpx6 — Helm's Missing YAML Content Leads To Panic

All advisories for CWE-908

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor