Overview 1,084 matches · 1 in Waratek scope · 0 protected · 11 exploited · 4 CISA KEV · 11 public PoC · 5 EPSS ≥ 0.5
1,084matches
1in Waratek scope0.1%
0protected0.0%
11exploited1.0%
4CISA KEV0.4%
11public PoC1.0%
5EPSS ≥ 0.50.5%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
1
0.1%
Outside Waratek scope
9
0.8%
Not applicable
1,074
99.1%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
1,084
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 384 / year
20071
Not applicable1
High1
not blocked1
Forecast only1
20086
Not applicable6
Critical1
High5
not blocked6
Exploited1
No public exploit5
20094
Not applicable4
High4
not blocked4
Exploited1
Working exploit published1
No public exploit2
20106
Not applicable6
High6
not blocked6
No public exploit6
201112
Not applicable12
High12
not blocked12
Exploited1
No public exploit11
20121
Not applicable1
Critical1
not blocked1
No public exploit1
20130
20140
20153
Not applicable3
Critical1
High2
not blocked3
No public exploit3
20162
Not applicable2
Medium2
not blocked2
No public exploit2
20174
Not applicable4
High1
Medium3
not blocked4
Working exploit published1
No public exploit3
201821
Not applicable21
Critical2
High8
Medium10
Low1
not blocked21
Exploited2
No public exploit19
201975
Outside Waratek scope4
Not applicable71
Critical8
High15
Medium52
not blocked75
No public exploit75
202056
Outside Waratek scope3
Not applicable53
Critical4
High17
Medium33
Low2
not blocked56
Exploited1
Proof of concept only1
Forecast only1
No public exploit53
202172
Outside Waratek scope1
Not applicable71
Critical29
High22
Medium17
Low4
not blocked72
Proof of concept only1
No public exploit71
202247
No exploit published1
Not applicable46
Critical2
High19
Medium25
Low1
not blocked47
Proof of concept only4
No public exploit43
202344
Not applicable44
Critical2
High21
Medium21
not blocked44
Exploited1
Proof of concept only7
Forecast only1
No public exploit35
2024186
Outside Waratek scope1
Not applicable185
Critical7
High79
Medium91
Low9
not blocked186
Exploited2
Proof of concept only2
No public exploit182
2025160
Not applicable160
Critical12
High45
Medium102
Low1
not blocked160
Exploited1
Proof of concept only2
No public exploit157
2026384
Not applicable384
Critical10
High94
Medium247
Low33
not blocked384
Exploited1
Proof of concept only19
No public exploit364
2008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-80091 | Medium | 2026-09-08 | Not applicable | No public exploit | Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-78519 | High | 2026-09-08 | Not applicable | No public exploit | Use of uninitialized resource in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
| CVE-2026-72989 | High | 2026-09-08 | Not applicable | No public exploit | Use of uninitialized resource in Windows Failover Cluster allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-72945 | Medium | 2026-09-08 | Not applicable | No public exploit | Use of uninitialized resource in Windows Task Scheduler allows an authorized attacker to disclose information locally. |
| CVE-2026-70290 | Medium | 2026-09-08 | Not applicable | No public exploit | Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. |
| CVE-2026-69853 | Medium | 2026-09-08 | Not applicable | No public exploit | Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally. |
| CVE-2026-69770 | Medium | 2026-09-08 | Not applicable | No public exploit | Use of uninitialized resource in Windows Spaceport.sys allows an authorized attacker to disclose information locally. |
| CVE-2026-69672 | Medium | 2026-09-08 | Not applicable | No public exploit | Use of uninitialized resource in Windows DNS allows an authorized attacker to disclose information locally. |
| CVE-2026-69485 | High | 2026-09-08 | Not applicable | No public exploit | Use of uninitialized resource in Remote Desktop Client allows an authorized attacker to execute code over a network. |
| CVE-2026-69358 | High | 2026-09-08 | Not applicable | No public exploit | Use of uninitialized resource in Remote Desktop Client allows an authorized attacker to execute code over a network. |
| CVE-2026-69349 | Medium | 2026-09-08 | Not applicable | No public exploit | Use of uninitialized resource in Windows Management Instrumentation allows an authorized attacker to disclose information over a network. |
| CVE-2026-69288 | Medium | 2026-09-08 | Not applicable | No public exploit | Use of uninitialized resource in Windows GDI+ allows an authorized attacker to disclose information locally. |
| CVE-2026-68873 | Medium | 2026-09-08 | Not applicable | No public exploit | Insertion of sensitive information into log file in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information locally. |
| CVE-2026-68852 | Medium | 2026-09-08 | Not applicable | No public exploit | Use of uninitialized resource in Microsoft Account allows an authorized attacker to disclose information locally. |
| CVE-2026-68776 | Medium | 2026-09-08 | Not applicable | No public exploit | Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. |
| CVE-2026-67648 | Medium | 2026-09-08 | Not applicable | No public exploit | Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. |
| CVE-2026-67386 | Medium | 2026-09-08 | Not applicable | No public exploit | Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. |
| CVE-2026-85089 | High | 2026-09-03 | Not applicable | Proof of concept only | FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_info_ex) use Stream_Seek instead of Stream_Zero for reserved pad bytes (up to 576 bytes), leaving previously freed heap contents in the outgoing PDU. Because the send buffer is allocated with malloc (not zeroed), stale heap data — which may include cleartext credentials from prior sessions — can be sent to the receiving peer. FreeRDP-based servers using rdpUpdate::SaveSessionInfo and freerdp-proxy (which forwards these PDUs) are affected, allowing disclosure of server/proxy process memory to a downstream client. |
| CVE-2026-84326 | High | 2026-09-02 | Not applicable | No public exploit | Uninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-84267 | Medium | 2026-09-01 | Not applicable | Proof of concept only | A flaw was found in the SFTP backend in gvfs. When mounting a share, a malicious SFTP server can cause read_string() to allocate a buffer with a certain length but the function does not verify that the buffer is completely filled, leaving the remainder of the buffer containing uninitialized heap contents. If the server sends a short FXP_HANDLE reply, these uninitialized bytes are taken as the file handle. The client will then echo these uninitialized bytes back to the server on all subsequent requests using that handle. With a length of 128 bytes, this issue allows the malicious server to deterministically read uninitialized heap memory from the gvfsd-sftp process, leaking its heap base and the load address of the libgio library, resulting in a deterministic defeat of Address Space Layout Randomization (ASLR). |
| CVE-2026-79285 | Medium | 2026-08-25 | Not applicable | No public exploit | Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-79270 | Medium | 2026-08-25 | Not applicable | No public exploit | Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-79269 | Medium | 2026-08-25 | Not applicable | No public exploit | Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-79229 | Medium | 2026-08-25 | Not applicable | No public exploit | Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-79221 | Medium | 2026-08-25 | Not applicable | No public exploit | Uninitialized resource in Dawn in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-79120 | Medium | 2026-08-25 | Not applicable | No public exploit | Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-79118 | Medium | 2026-08-25 | Not applicable | No public exploit | Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-79040 | Medium | 2026-08-25 | Not applicable | No public exploit | Uninitialized resource in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-79007 | Low | 2026-08-25 | Not applicable | No public exploit | Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-78986 | Low | 2026-08-25 | Not applicable | No public exploit | Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-78984 | Low | 2026-08-25 | Not applicable | No public exploit | Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-78977 | Medium | 2026-08-25 | Not applicable | No public exploit | Uninitialized resource in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-78969 | Medium | 2026-08-25 | Not applicable | No public exploit | Uninitialized resource in Video in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-78965 | Medium | 2026-08-25 | Not applicable | No public exploit | Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-78962 | Medium | 2026-08-25 | Not applicable | No public exploit | Uninitialized resource in WebXR in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-78958 | Low | 2026-08-25 | Not applicable | No public exploit | Uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-78914 | Medium | 2026-08-25 | Not applicable | No public exploit | Uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-62986 | Medium | 2026-08-25 | Not applicable | No public exploit | OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13, the PyOpenEXR Python bindings return stale heap data when reading a crafted deep scanline EXR that uses layer-prefixed RGB channels. With the default channel coalescing (separate_channels=False), the wrapper groups channels such as left.R, left.G, and left.B into a single RGB sample array, but the lane-offset calculation in PyPart::setDeepSliceData() only recognizes the exact unprefixed names G, B, and A. As a result, prefixed channels like left.G and left.B are decoded into lane 0 while lanes 1 and 2 are left uninitialized and returned to Python. A Python application that reads untrusted deep EXR files through the default OpenEXR.File API and then logs, serializes, previews, or otherwise processes the resulting NumPy sample arrays may expose uninitialized same-process heap contents, in addition to receiving incorrect green and blue channel data. This issue is fixed in versions 3.3.13 and 3.4.14. |
| CVE-2026-63381 | Medium | 2026-08-20 | Not applicable | No public exploit | Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbuffer_add_buffer_reference processes an output buffer whose out_total_len is zero. evbuffer_free_all_chains frees the initial empty chain without resetting outbuf->first, outbuf->last, or outbuf->last_with_datap, and APPEND_CHAIN_MULTICAST subsequently dereferences the dangling chain pointer. A caller that can drive this buffer state can cause memory corruption or a process crash. This issue is fixed in versions 2.1.13 and 2.2.2-alpha. |
| CVE-2026-19448 | High | 2026-08-20 | Not applicable | No public exploit | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 A stack memory corruption vulnerability exists in the AIX IPsec ESP decapsulation handler. Successful exploitation may corrupt kernel stack state and cause a system crash, resulting in denial of service. |
| CVE-2026-58084 | Medium | 2026-08-19 | Not applicable | No public exploit | To retrieve the previous timer value, the kernel calls realtimer_gettime(), which obtains the current time for the timer's clock. For a timer using CLOCK_TAI this can fail when no TAI offset has been configured, but the error return was not checked, so the uninitialized output buffer was copied to userspace. An unprivileged local user can obtain uninitialized kernel stack memory by creating a POSIX timer with CLOCK_TAI and calling timer_settime(2), potentially disclosing sensitive kernel data. |
| CVE-2026-49425 | Medium | 2026-08-19 | Not applicable | No public exploit | The compat32 kevent() handler translates a 64-bit kevent struct into a stack- declared 32-bit struct. It did not first zero the stack struct. An unprivileged user may observe a small amount of uninitialized kernel stack data, which may contain sensitive information. |
| CVE-2026-49424 | Medium | 2026-08-19 | Not applicable | No public exploit | The Linux waitid() implementation translates a FreeBSD siginfo_t struct into a stack-declared Linux siginfo_t. It did not first zero the stack struct. An unprivileged user may observe 104 bytes of uninitialized kernel stack data, which may contain sensitive information. |
| CVE-2026-49423 | Low | 2026-08-19 | Not applicable | No public exploit | When building the iovec array for a received TLS 1.2 CBC record, ktls_ocf_tls_cbc_decrypt() incremented the iovec index for every mbuf in the chain, including mbufs that were skipped because they contained only TLS header bytes. This left uninitialized entries in the iovec array. The iovec array was allocated without zeroing. A remote TLS peer can cause the kernel to read from uninitialized iovec entries during HMAC computation, resulting in a kernel panic. The peer must be able to control TCP segmentation such that the first mbuf of a CBC record contains only the 5-byte TLS record header. |
| CVE-2026-16827 | Medium | 2026-08-19 | Not applicable | No public exploit | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to the use of an uninitialized stack pointer. |
| CVE-2026-76042 | Low | 2026-08-18 | Not applicable | No public exploit | Use of uninitialized resource in GPU in Google Chrome prior to 151.0.7922.169 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-62377 | Medium | 2026-08-18 | Not applicable | No public exploit | libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heif_context_read_from_memory() can leave the context with no registered sequence tracks and crash when heif_context_get_track(ctx, 0) is called. HeifContext::get_track() in libheif/context.cc executes assert(has_sequence()) before its normal error handling, so assert-enabled builds abort instead of allowing the public wrapper in libheif/api/libheif/heif_sequences.cc to return null. In release builds, removing the assertion lets the track_id zero path dereference m_tracks.begin()->second on an empty map, which is undefined behavior and typically crashes. The issue is reachable through documented public APIs after parsing attacker-controlled bytes. This issue is fixed in version 1.23.1. |
| CVE-2026-70459 | Medium | 2026-08-13 | Not applicable | No public exploit | rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remote attackers to crash the daemon by sending a file list whose first entry is a dot entry not typed as a directory. The daemon dereferences the first file list entry as a directory structure pointer without verifying the entry type, resulting in an invalid or uninitialized pointer dereference that terminates the client connection. |
| CVE-2026-16868 | High | 2026-08-13 | Not applicable | No public exploit | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the use of uninitialized memory during ASN.1 length processing. |
| CVE-2026-0301 | Low | 2026-08-13 | Not applicable | No public exploit | An information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS® software enables an unauthenticated user with network access to obtain sensitive information. Panorama is not impacted by this vulnerability. |
| CVE-2026-70317 | Medium | 2026-08-11 | Not applicable | No public exploit | Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally. |
| CVE-2026-68799 | Medium | 2026-08-11 | Not applicable | No public exploit | Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
| CVE-2026-62740 | Medium | 2026-08-11 | Not applicable | No public exploit | Use of uninitialized resource in Windows Imaging Component allows an authorized attacker to disclose information locally. |
| CVE-2026-62709 | Medium | 2026-08-11 | Not applicable | No public exploit | Use of uninitialized resource in Windows GDI+ allows an authorized attacker to disclose information locally. |
| CVE-2026-59137 | Medium | 2026-08-11 | Not applicable | No public exploit | Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally. |
| CVE-2026-59136 | Medium | 2026-08-11 | Not applicable | No public exploit | Use of uninitialized resource in Microsoft COM for Windows allows an authorized attacker to disclose information locally. |
| CVE-2026-58247 | Medium | 2026-08-11 | Not applicable | No public exploit | SAP ABAP Platform allows an unauthenticated user to send a specially crafted request to an internal component. This could disclose limited, non-sensitive data from previously used memory, leading to a low on confidentiality, with no impact on integrity and availability of the application. |
| CVE-2026-6368 | Low | 2026-08-10 | Not applicable | No public exploit | Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process. |
| CVE-2026-11809 | Low | 2026-08-10 | Not applicable | No public exploit | The UpdateHub OTA client in subsys/mgmt/updatehub/updatehub.c contains an out-of-bounds / uninitialized-memory read in z_impl_updatehub_probe(). The probe response from the UpdateHub server is copied into a heap buffer (metadata) that is correctly NUL-terminated, but a second buffer (metadata_copy) is allocated with k_malloc (unzeroed) and filled with memcpy(metadata_copy, metadata, strlen(metadata)), which omits the terminating NUL. Everything after the copied content remains uninitialized heap. When the first json_obj_parse() over the array descriptor fails, the code falls back to json_obj_parse(metadata_copy, strlen(metadata_copy), ...). The strlen() call scans past the copied bytes through uninitialized heap and, if no zero byte is found before the end of the allocation, reads beyond the buffer; the resulting over-long length is then parsed as JSON. The probe payload is fully controlled by the (malicious, compromised, or — without the optional CONFIG_UPDATEHUB_DTLS — on-path) UpdateHub server, which can craft a large payload that fails the first parse to drive this path. The consequence is a read of uninitialized heap, with a worst case of an out-of-bounds read past the metadata_copy allocation that can fault and crash the update thread/device, producing a network-triggerable denial of service. The over-read data is consumed only internally to evaluate the update and is not returned to the attacker, so there is no direct information disclosure and no out-of-bounds write. The fix zeroes metadata_copy with memset before the copy, guaranteeing NUL termination and bounding strlen() within the allocation. |
| CVE-2026-70631 | Medium | 2026-08-06 | Not applicable | No public exploit | FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services. |
| CVE-2026-70630 | Medium | 2026-08-06 | Not applicable | No public exploit | FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services. |
| CVE-2026-70629 | Medium | 2026-08-06 | Not applicable | No public exploit | FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rscc_decode_frame() calls av_image_copy_plane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services. |
| CVE-2026-68744 | Low | 2026-08-04 | Not applicable | No public exploit | A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process. |
| CVE-2026-64479 | Low | 2026-07-25 | Not applicable | No public exploit | In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() snd_seq_event_dup() copies an incoming event into a pool cell and, in the UMP-enabled build, clears the trailing cell->ump.raw.extra word that the memcpy() did not cover. The guard deciding whether to clear it compares the copied size against sizeof(cell->event): memcpy(&cell->ump, event, size); if (size < sizeof(cell->event)) cell->ump.raw.extra = 0; For a legacy (non-UMP) event, size == sizeof(struct snd_seq_event) == sizeof(cell->event), so the condition is false and the extra word keeps stale data. The cell pool is allocated with kvmalloc() (not zeroed) and cells are reused via a free list, so that word holds uninitialised heap or leftover event data. When such a cell is delivered to a UMP client (client->midi_version > 0) that set SNDRV_SEQ_FILTER_NO_CONVERT -- so the legacy event reaches it unconverted -- snd_seq_read() reads it out as the larger struct snd_seq_ump_event and copies the stale word to user space, a 4-byte kernel heap infoleak to an unprivileged /dev/snd/seq client. Compare against sizeof(cell->ump) instead, so the trailing word is zeroed for every event shorter than the UMP cell. |
| CVE-2026-64413 | High | 2026-07-25 | Not applicable | No public exploit | In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: zero chainstack array sashiko reports: looking at ebtables table translation, could a sparse cpu_possible_mask lead to an uninitialized pointer free? If cpu_possible_mask is sparse (for example, CPU 0 and CPU 2 are possible, but CPU 1 is not), the allocation loop skips CPU 1. If vmalloc_node() fails at CPU 2, the cleanup loop will blindly decrement and call vfree() on newinfo->chainstack[1]. Not a real-world bug, such allocation isn't expected to fail in the first place. |
| CVE-2026-64360 | Medium | 2026-07-25 | Not applicable | No public exploit | In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: zero-initialize buffer in hfs_bnode_read hfs_bnode_read() can return early without writing to the output buffer when is_bnode_offset_valid() fails or when check_and_correct_requested_ length() corrects the length to zero. Callers such as hfs_bnode_read_ u16() and hfs_bnode_read_u8() pass stack-allocated buffers and use the result unconditionally, leading to KMSAN uninit-value reports. Rather than initializing at each individual call site, zero the buffer at the start of hfs_bnode_read() before any validation checks. This ensures all callers in both hfs and hfsplus get a deterministic zero value regardless of which early-return path is taken. |
| CVE-2026-64309 | Medium | 2026-07-25 | Not applicable | No public exploit | In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT) Sashiko notes: > if SEV initialization fails and KVM is actively running normal VMs, could a > userspace process trigger this code path via /dev/sev ioctls (e.g., > SEV_PDH_GEN) and zero out MSR_VM_HSAVE_PA globally? Would the next VMRUN > execution for an active VM trigger a general protection fault and crash the > host? The SNP_COMMIT command does not require the firmware to be in any particular state. Skip initializing it if it was previously uninitialized. The SEV-SNP firmware specification doc 56860 does not mention SNP_COMMIT in Table 5 as a command that is allowed in the UNINIT state, but it is in fact allowed and a future documentation update will reflect that. |
| CVE-2026-66038 | High | 2026-07-24 | Not applicable | No public exploit | FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services. |
| CVE-2026-66034 | High | 2026-07-24 | Not applicable | No public exploit | libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2_publickey_list_fetch(), the version 1 response parser reads a server-controlled comment_len value and advances the parse pointer without verifying sufficient bytes remain in the buffer, causing the out-of-bounds read to leak heap pointers from adjacent allocations defeating ASLR, followed by heap allocator state corruption when the error cleanup path frees an uninitialized pointer from a non-zeroed realloc() region. |
| CVE-2026-64220 | Medium | 2026-07-24 | Not applicable | No public exploit | In the Linux kernel, the following vulnerability has been resolved: device property: set fwnode->secondary to NULL in fwnode_init() If a firmware node is allocated on the stack (for instance: temporary software node whose life-time we control) or on the heap - but using a non-zeroing allocation function - and initialized using fwnode_init(), its secondary pointer will contain uninitalized memory which likely will be neither NULL nor IS_ERR() and so may end up being dereferenced (for example: in dev_to_swnode()). Set fwnode->secondary to NULL on initialization. |
| CVE-2026-47247 | High | 2026-07-21 | Not applicable | Proof of concept only | libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.) can recover heap data - including library function pointers sufficient to defeat ASLR, or any other secret - from the publicly-downloadable transcoded JPEG/PNG/WebP output. Local attack vectors are also possible. Version 1.22.0 fixes the issue. |
| CVE-2026-16386 | High | 2026-07-21 | Not applicable | No public exploit | Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16385 | High | 2026-07-21 | Not applicable | No public exploit | Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16384 | High | 2026-07-21 | Not applicable | No public exploit | Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-64130 | Medium | 2026-07-19 | Not applicable | No public exploit | In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: fix initialization of tags of the huge zero folio with init_on_free __GFP_ZEROTAGS semantics are currently a bit weird, but effectively this flag is only ever set alongside __GFP_ZERO and __GFP_SKIP_KASAN. If we run with init_on_free, we will zero out pages during __free_pages_prepare(), to skip zeroing on the allocation path. However, when allocating with __GFP_ZEROTAG set, post_alloc_hook() will consequently not only skip clearing page content, but also skip clearing tag memory. Not clearing tags through __GFP_ZEROTAGS is irrelevant for most pages that will get mapped to user space through set_pte_at() later: set_pte_at() and friends will detect that the tags have not been initialized yet (PG_mte_tagged not set), and initialize them. However, for the huge zero folio, which will be mapped through a PMD marked as special, this initialization will not be performed, ending up exposing whatever tags were still set for the pages. The docs (Documentation/arch/arm64/memory-tagging-extension.rst) state that allocation tags are set to 0 when a page is first mapped to user space. That no longer holds with the huge zero folio when init_on_free is enabled. Fix it by decoupling __GFP_ZEROTAGS from __GFP_ZERO, passing to tag_clear_highpages() whether we want to also clear page content. Invert the meaning of the tag_clear_highpages() return value to have clearer semantics. Reproduced with the huge zero folio by modifying the check_buffer_fill arm64/mte selftest to use a 2 MiB area, after making sure that pages have a non-0 tag set when freeing (note that, during boot, we will not actually initialize tags, but only set KASAN_TAG_KERNEL in the page flags). $ ./check_buffer_fill 1..20 ... not ok 17 Check initial tags with private mapping, sync error mode and mmap memory not ok 18 Check initial tags with private mapping, sync error mode and mmap/mprotect memory ... This code needs more cleanups; we'll tackle that next, like decoupling __GFP_ZEROTAGS from __GFP_SKIP_KASAN. [akpm@linux-foundation.org: s/__GPF_ZERO/__GFP_ZERO/, per David] |
| CVE-2026-64082 | High | 2026-07-19 | Not applicable | No public exploit | In the Linux kernel, the following vulnerability has been resolved: riscv: Fix register corruption from uninitialized cregs on error compat_riscv_gpr_set() calls cregs_to_regs() unconditionally, even when user_regset_copyin() fails. Since cregs is an uninitialized stack variable, a copyin failure causes uninitialized stack data to be written into the target task's pt_regs, corrupting its register state and potentially leaking kernel stack contents. compat_restore_sigcontext() has the same issue: it calls cregs_to_regs() even when __copy_from_user() fails, leading to the same corruption of the signal-returning task's register state on error. Only call cregs_to_regs() when the user copy succeeds. |
| CVE-2026-63936 | Medium | 2026-07-19 | Not applicable | No public exploit | In the Linux kernel, the following vulnerability has been resolved: iio: adc: mt6359: fix unchecked return value in mt6358_read_imp In mt6358_read_imp(), the variable val_v is passed to regmap_read() but the return value is not checked. If the read fails, val_v remains uninitialized and its random stack content is subsequently reported as a measurement result. Initialize val_v to zero to ensure a predictable value is reported in case of bus failure and to prevent potential stack data leakage. This also satisfies static analyzers that might otherwise flag the variable as used uninitialized. |
| CVE-2026-63870 | High | 2026-07-19 | Not applicable | No public exploit | In the Linux kernel, the following vulnerability has been resolved: ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() The aoe driver (or similar) generates a non-IPv6 packet (e.g., ETH_P_AOE) and queues it for transmission via dev_queue_xmit() on a 6LoWPAN interface (configured by the user or test case). Since the packet is not IPv6, the 6LoWPAN header_ops->create function (lowpan_header_create or header_create) returns early without initializing the lowpan_addr_info structure in the skb headroom. In the transmit function (lowpan_xmit), the driver calls lowpan_header (or setup_header) which unconditionally copies and uses the lowpan_addr_info from the headroom, which contains uninitialized data. Fix this by dropping non IPv6 packets. A similar fix is needed in net/bluetooth/6lowpan.c bt_xmit(). |
| CVE-2026-63857 | Critical | 2026-07-19 | Not applicable | No public exploit | In the Linux kernel, the following vulnerability has been resolved: net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit() The transmit loop in airoha_dev_xmit() reads fragment address and length during its final iteration, when the loop index equals skb_shinfo(skb)->nr_frags, at which point the fragment data is uninitialized. While these values are never consumed, the read itself is unsafe and may trigger a page fault. Fix this by avoiding the fragment read on the last iteration. Additionally, move the skb pointer from the first to the last used packet descriptor, so that airoha_qdma_tx_napi_poll() defers freeing the skb until the final descriptor is processed. |
| CVE-2026-53379 | Medium | 2026-07-19 | Not applicable | No public exploit | In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov8856: free control handler on error in ov8856_init_controls() The control handler wasn't freed if adding controls failed, add an error exit label and convert the existing error return to use it. |
| CVE-2026-60005 | High | 2026-07-15 | Not applicable | No public exploit | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart. Impact: This vulnerability may allow remote, unauthenticated attackers to have limited control to disclose memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only. Note: The ngx_http_slice_module module is not enabled by default; it's enabled with the --with-http_slice_module configuration parameter. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2026-58546 | Medium | 2026-07-14 | Not applicable | No public exploit | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-58535 | High | 2026-07-14 | Not applicable | No public exploit | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-58533 | High | 2026-07-14 | Not applicable | No public exploit | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-57982 | Medium | 2026-07-14 | Not applicable | No public exploit | Use of uninitialized resource in Windows RDP allows an authorized attacker to disclose information over a network. |
| CVE-2026-57084 | Medium | 2026-07-14 | Not applicable | No public exploit | Use of uninitialized resource in Windows File Explorer allows an unauthorized attacker to disclose information locally. |
| CVE-2026-57083 | Medium | 2026-07-14 | Not applicable | No public exploit | Use of uninitialized resource in Microsoft Windows Codecs Library allows an unauthorized attacker to disclose information locally. |
| CVE-2026-56190 | Critical | 2026-07-14 | Not applicable | No public exploit | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to execute code over a network. |
| CVE-2026-55949 | High | 2026-07-14 | Not applicable | No public exploit | Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| CVE-2026-55042 | Medium | 2026-07-14 | Not applicable | No public exploit | Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally. |
| CVE-2026-55003 | Medium | 2026-07-14 | Not applicable | No public exploit | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-54997 | Medium | 2026-07-14 | Not applicable | No public exploit | Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally. |
| CVE-2026-50690 | Medium | 2026-07-14 | Not applicable | No public exploit | Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally. |
| CVE-2026-50497 | High | 2026-07-14 | Not applicable | No public exploit | Off-by-one error in Windows Remote Desktop Protocol allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-50455 | Medium | 2026-07-14 | Not applicable | No public exploit | Use of uninitialized resource in Universal Plug and Play (upnp.dll) allows an authorized attacker to disclose information locally. |
| CVE-2026-50376 | Medium | 2026-07-14 | Not applicable | No public exploit | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-49801 | Medium | 2026-07-14 | Not applicable | No public exploit | Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally. |
| CVE-2026-49165 | High | 2026-07-14 | Not applicable | No public exploit | Use of uninitialized resource in Microsoft Windows App Store allows an authorized attacker to disclose information locally. |
| CVE-2026-40422 | Medium | 2026-07-14 | Not applicable | No public exploit | Use of uninitialized resource in Windows File Explorer allows an authorized attacker to disclose information locally. |
| CVE-2026-56085 | Low | 2026-07-03 | Not applicable | No public exploit | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an use of uninitialized resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure. |