Common Weakness Enumeration
CWE-457
AllowedUse of Uninitialized Variable
Abstraction: Variant · Status: Draft
The code uses a variable that has not been initialized, leading to unpredictable or unintended results.
332 vulnerabilities reference this CWE, most recent first.
GHSA-34Q9-M777-QWWQ
Vulnerability from github – Published: 2026-07-30 03:31 – Updated: 2026-07-30 18:31
VLAI
Details
Uninitialized Use in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-17707"
],
"database_specific": {
"cwe_ids": [
"CWE-457"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-30T01:16:33Z",
"severity": "MODERATE"
},
"details": "Uninitialized Use in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)",
"id": "GHSA-34q9-m777-qwwq",
"modified": "2026-07-30T18:31:28Z",
"published": "2026-07-30T03:31:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17707"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/519701233"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-354C-38FF-3CW6
Vulnerability from github – Published: 2024-06-25 03:31 – Updated: 2024-07-03 18:46
VLAI
Details
A maliciously crafted MODEL file, when parsed in ASMkern229A.dllthrough Autodesk applications, can be used to uninitialized variables. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2024-37002"
],
"database_specific": {
"cwe_ids": [
"CWE-457",
"CWE-863",
"CWE-908"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-25T03:15:10Z",
"severity": "HIGH"
},
"details": "A maliciously crafted MODEL file, when parsed in ASMkern229A.dllthrough Autodesk applications, can be used to uninitialized variables. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.",
"id": "GHSA-354c-38ff-3cw6",
"modified": "2024-07-03T18:46:48Z",
"published": "2024-06-25T03:31:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37002"
},
{
"type": "WEB",
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-365P-M6G8-HHGP
Vulnerability from github – Published: 2021-12-15 00:01 – Updated: 2022-07-26 00:01
VLAI
Details
A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll is vulnerable to use of uninitialized memory while parsing user supplied TIFF files. This could allow an attacker to cause a denial-of-service condition.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2021-44003"
],
"database_specific": {
"cwe_ids": [
"CWE-457",
"CWE-908"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-14T12:15:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been identified in JT2Go (All versions \u003c V13.2.0.5), Teamcenter Visualization (All versions \u003c V13.2.0.5). The Tiff_Loader.dll is vulnerable to use of uninitialized memory while parsing user supplied TIFF files. This could allow an attacker to cause a denial-of-service condition.",
"id": "GHSA-365p-m6g8-hhgp",
"modified": "2022-07-26T00:01:12Z",
"published": "2021-12-15T00:01:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44003"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-36P6-H78P-CX2W
Vulnerability from github – Published: 2026-02-10 21:31 – Updated: 2026-02-10 21:31
VLAI
Details
Improper Initialization within the AMD Secure Encrypted Virtualization (SEV) firmware can allow an admin privileged attacker to corrupt RMP covered memory, potentially resulting in loss of guest memory integrity
Severity
{
"affected": [],
"aliases": [
"CVE-2025-29952"
],
"database_specific": {
"cwe_ids": [
"CWE-457"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-10T20:16:44Z",
"severity": "MODERATE"
},
"details": "Improper Initialization within the AMD Secure Encrypted Virtualization (SEV) firmware can allow an admin privileged attacker to corrupt RMP covered memory, potentially resulting in loss of guest memory integrity",
"id": "GHSA-36p6-h78p-cx2w",
"modified": "2026-02-10T21:31:31Z",
"published": "2026-02-10T21:31:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29952"
},
{
"type": "WEB",
"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3023.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-377P-G8GR-5WPG
Vulnerability from github – Published: 2024-05-03 18:30 – Updated: 2026-06-06 00:28
VLAI
Summary
LIEF obtain sensitive information via the name parameter
Details
An issue in LIEF v.0.14.1 allows a local attacker to obtain sensitive information via the name parameter of the machd_reader.c component.
Severity
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "lief"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.15.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-31636"
],
"database_specific": {
"cwe_ids": [
"CWE-457"
],
"github_reviewed": true,
"github_reviewed_at": "2024-11-22T20:26:56Z",
"nvd_published_at": "2024-05-03T17:15:07Z",
"severity": "LOW"
},
"details": "An issue in LIEF v.0.14.1 allows a local attacker to obtain sensitive information via the name parameter of the machd_reader.c component.",
"id": "GHSA-377p-g8gr-5wpg",
"modified": "2026-06-06T00:28:36Z",
"published": "2024-05-03T18:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31636"
},
{
"type": "WEB",
"url": "https://github.com/lief-project/LIEF/issues/1038"
},
{
"type": "WEB",
"url": "https://github.com/lief-project/LIEF/commit/307e113f8e00b034f0a5f1baa33e54d636c52ea3"
},
{
"type": "PACKAGE",
"url": "https://github.com/lief-project/LIEF"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/lief/PYSEC-2024-280.yaml"
},
{
"type": "WEB",
"url": "http://lief.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "LIEF obtain sensitive information via the name parameter"
}
GHSA-37J8-4GFM-7J42
Vulnerability from github – Published: 2026-07-30 03:31 – Updated: 2026-07-30 15:31
VLAI
Details
Uninitialized Use in WebGL in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-17808"
],
"database_specific": {
"cwe_ids": [
"CWE-457"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-30T01:16:44Z",
"severity": "MODERATE"
},
"details": "Uninitialized Use in WebGL in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)",
"id": "GHSA-37j8-4gfm-7j42",
"modified": "2026-07-30T15:31:42Z",
"published": "2026-07-30T03:31:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17808"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/516778390"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-395X-3X8Q-MV38
Vulnerability from github – Published: 2022-05-17 02:02 – Updated: 2026-05-29 21:31
VLAI
Details
The key_certify function in usr.bin/ssh/key.c in OpenSSH 5.6 and 5.7, when generating legacy certificates using the -t command-line option in ssh-keygen, does not initialize the nonce field, which might allow remote attackers to obtain sensitive stack memory contents or make it easier to conduct hash collision attacks.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2011-0539"
],
"database_specific": {
"cwe_ids": [
"CWE-457"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2011-02-10T18:00:00Z",
"severity": "MODERATE"
},
"details": "The key_certify function in usr.bin/ssh/key.c in OpenSSH 5.6 and 5.7, when generating legacy certificates using the -t command-line option in ssh-keygen, does not initialize the nonce field, which might allow remote attackers to obtain sensitive stack memory contents or make it easier to conduct hash collision attacks.",
"id": "GHSA-395x-3x8q-mv38",
"modified": "2026-05-29T21:31:10Z",
"published": "2022-05-17T02:02:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-0539"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65163"
},
{
"type": "WEB",
"url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02794777"
},
{
"type": "WEB",
"url": "http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10673"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/43181"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/44269"
},
{
"type": "WEB",
"url": "http://www.openssh.com/txt/legacy-cert.adv"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2011/02/04/2"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/46155"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1025028"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2011/0284"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3FP8-PM45-CC3H
Vulnerability from github – Published: 2026-06-05 00:31 – Updated: 2026-06-06 06:30
VLAI
Details
Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-11138"
],
"database_specific": {
"cwe_ids": [
"CWE-457"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-04T23:17:19Z",
"severity": "MODERATE"
},
"details": "Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)",
"id": "GHSA-3fp8-pm45-cc3h",
"modified": "2026-06-06T06:30:28Z",
"published": "2026-06-05T00:31:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11138"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/501650354"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3G3J-WMQV-CCGW
Vulnerability from github – Published: 2026-06-05 00:31 – Updated: 2026-06-05 18:31
VLAI
Details
Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-11087"
],
"database_specific": {
"cwe_ids": [
"CWE-457"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-04T23:17:13Z",
"severity": "MODERATE"
},
"details": "Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)",
"id": "GHSA-3g3j-wmqv-ccgw",
"modified": "2026-06-05T18:31:35Z",
"published": "2026-06-05T00:31:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11087"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/500140149"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3H3X-2HWV-HR52
Vulnerability from github – Published: 2024-10-01 21:31 – Updated: 2026-08-25 15:31
VLAI
Summary
Golang FIPS OpenSSL has a Use of Uninitialized Variable vulnerability
Details
A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack.
Severity
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/golang-fips/openssl"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.0.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-9355"
],
"database_specific": {
"cwe_ids": [
"CWE-457"
],
"github_reviewed": true,
"github_reviewed_at": "2024-10-01T22:31:42Z",
"nvd_published_at": "2024-10-01T19:15:09Z",
"severity": "HIGH"
},
"details": "A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.\u00a0 It is also possible to force a derived key to be all zeros instead of an unpredictable value.\u00a0 This may have follow-on implications for the Go TLS stack.",
"id": "GHSA-3h3x-2hwv-hr52",
"modified": "2026-08-25T15:31:25Z",
"published": "2024-10-01T21:31:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355"
},
{
"type": "WEB",
"url": "https://github.com/golang-fips/openssl/pull/198"
},
{
"type": "WEB",
"url": "https://github.com/github/advisory-database/pull/4950"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2024-3167"
},
{
"type": "PACKAGE",
"url": "https://github.com/golang-fips/openssl"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2024-9355"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:59439"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:55525"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:55520"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:7624"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:7256"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:7118"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:2416"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:9551"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:8847"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:8678"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:8327"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:7550"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:7502"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:10133"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Golang FIPS OpenSSL has a Use of Uninitialized Variable vulnerability"
}
Mitigation MIT-57
Implementation
Strategy: Attack Surface Reduction
Ensure that critical variables are initialized before first use [REF-1485].
Mitigation
Build and Compilation
Strategy: Compilation or Build Hardening
Most compilers will complain about the use of uninitialized variables if warnings are turned on.
Mitigation
Implementation
Operation
When using a language that does not require explicit declaration of variables, run or compile the software in a mode that reports undeclared or unknown variables. This may indicate the presence of a typographic error in the variable's name.
Mitigation
Requirements
Strategy: Language Selection
Choose a language that is not susceptible to these issues.
Mitigation
Architecture and Design
Mitigating technologies such as safe string libraries and container abstractions could be introduced.
No CAPEC attack patterns related to this CWE.