CWE-908

{
  "affected": [],
  "aliases": [
    "CVE-2024-43845"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-908"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-17T10:15:09Z",
    "severity": "LOW"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: Fix bogus checksum computation in udf_rename()\n\nSyzbot reports uninitialized memory access in udf_rename() when updating\nchecksum of \u0027..\u0027 directory entry of a moved directory. This is indeed\ntrue as we pass on-stack diriter.fi to the udf_update_tag() and because\nthat has only struct fileIdentDesc included in it and not the impUse or\nname fields, the checksumming function is going to checksum random stack\ncontents beyond the end of the structure. This is actually harmless\nbecause the following udf_fiiter_write_fi() will recompute the checksum\nfrom on-disk buffers where everything is properly included. So all that\nis needed is just removing the bogus calculation.",
  "id": "GHSA-pqp2-hjwx-f6qp",
  "modified": "2024-10-25T21:31:26Z",
  "published": "2024-08-17T12:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43845"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/27ab33854873e6fb958cb074681a0107cc2ecc4c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/40d7b3ed52449d36143bab8d3e70926aa61a60f4"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9c439311c13fc6faab1921441165c9b8b500c83b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c996b570305e7a6910c2ce4cdcd4c22757ffe241"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fe2ead240c31e8d158713beca9d0681a6e6a53ab"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-102635"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-908"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-29T17:17:07Z",
    "severity": "MODERATE"
  },
  "details": "ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder\u0027s application extension handler in coders/gif.c. Attackers can craft malicious GIF files that cause the number parser to read uninitialized heap memory and store contents as image metadata, disclosing sensitive heap information.",
  "id": "GHSA-prg6-qcxr-rp63",
  "modified": "2026-09-29T18:31:50Z",
  "published": "2026-09-29T18:31:50Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rvv7-5mh8-vcfc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102635"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ImageMagick/ImageMagick/commit/a0ca2c739c0216ff4efbd631d1ba7fd54dba1ff4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ImageMagick/ImageMagick6/commit/95dc0fd21a684bfac2bdb6fb6638c0ab271adbe5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ImageMagick/ImageMagick"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ImageMagick/ImageMagick/blob/7.1.2-31/coders/gif.c#L1168-L1196"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-32-and-6.9.13-57-uninitialized-heap-memory-disclosure-in-gif-decoder"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-9381"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-908"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-02T20:15:05Z",
    "severity": "HIGH"
  },
  "details": "In gatts_process_read_by_type_req of gatt_sr.c, there is a possible\u00a0information disclosure due to uninitialized data. This could lead to remote\u00a0information disclosure with no additional execution privileges needed. User\u00a0interaction is not needed for exploitation.",
  "id": "GHSA-pvf4-gmq6-p9cx",
  "modified": "2024-12-18T21:30:51Z",
  "published": "2024-12-02T21:31:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-9381"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/docs/security/bulletin/pixel/2018-06-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-20638"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-457",
      "CWE-908"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-03T04:15:08Z",
    "severity": "MODERATE"
  },
  "details": "In DA, there is a possible read of uninitialized heap data due to uninitialized data. This could lead to local information disclosure, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS09291449; Issue ID: MSV-2066.",
  "id": "GHSA-pvh9-2948-mgmj",
  "modified": "2025-02-03T18:30:41Z",
  "published": "2025-02-03T06:30:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20638"
    },
    {
      "type": "WEB",
      "url": "https://corp.mediatek.com/product-security-bulletin/February-2025"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-47687"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-908"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-21T12:15:05Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nvdpa/mlx5: Fix invalid mr resource destroy\n\nCertain error paths from mlx5_vdpa_dev_add() can end up releasing mr\nresources which never got initialized in the first place.\n\nThis patch adds the missing check in mlx5_vdpa_destroy_mr_resources()\nto block releasing non-initialized mr resources.\n\nReference trace:\n\n  mlx5_core 0000:08:00.2: mlx5_vdpa_dev_add:3274:(pid 2700) warning: No mac address provisioned?\n  BUG: kernel NULL pointer dereference, address: 0000000000000000\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  PGD 140216067 P4D 0\n  Oops: 0000 [#1] PREEMPT SMP NOPTI\n  CPU: 8 PID: 2700 Comm: vdpa Kdump: loaded Not tainted 5.14.0-496.el9.x86_64 #1\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n  RIP: 0010:vhost_iotlb_del_range+0xf/0xe0 [vhost_iotlb]\n  Code: [...]\n  RSP: 0018:ff1c823ac23077f0 EFLAGS: 00010246\n  RAX: ffffffffc1a21a60 RBX: ffffffff899567a0 RCX: 0000000000000000\n  RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000000000000000\n  RBP: ff1bda1f7c21e800 R08: 0000000000000000 R09: ff1c823ac2307670\n  R10: ff1c823ac2307668 R11: ffffffff8a9e7b68 R12: 0000000000000000\n  R13: 0000000000000000 R14: ff1bda1f43e341a0 R15: 00000000ffffffea\n  FS:  00007f56eba7c740(0000) GS:ff1bda269f800000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 0000000000000000 CR3: 0000000104d90001 CR4: 0000000000771ef0\n  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n  PKRU: 55555554\n  Call Trace:\n\n   ? show_trace_log_lvl+0x1c4/0x2df\n   ? show_trace_log_lvl+0x1c4/0x2df\n   ? mlx5_vdpa_free+0x3d/0x150 [mlx5_vdpa]\n   ? __die_body.cold+0x8/0xd\n   ? page_fault_oops+0x134/0x170\n   ? __irq_work_queue_local+0x2b/0xc0\n   ? irq_work_queue+0x2c/0x50\n   ? exc_page_fault+0x62/0x150\n   ? asm_exc_page_fault+0x22/0x30\n   ? __pfx_mlx5_vdpa_free+0x10/0x10 [mlx5_vdpa]\n   ? vhost_iotlb_del_range+0xf/0xe0 [vhost_iotlb]\n   mlx5_vdpa_free+0x3d/0x150 [mlx5_vdpa]\n   vdpa_release_dev+0x1e/0x50 [vdpa]\n   device_release+0x31/0x90\n   kobject_cleanup+0x37/0x130\n   mlx5_vdpa_dev_add+0x2d2/0x7a0 [mlx5_vdpa]\n   vdpa_nl_cmd_dev_add_set_doit+0x277/0x4c0 [vdpa]\n   genl_family_rcv_msg_doit+0xd9/0x130\n   genl_family_rcv_msg+0x14d/0x220\n   ? __pfx_vdpa_nl_cmd_dev_add_set_doit+0x10/0x10 [vdpa]\n   ? _copy_to_user+0x1a/0x30\n   ? move_addr_to_user+0x4b/0xe0\n   genl_rcv_msg+0x47/0xa0\n   ? __import_iovec+0x46/0x150\n   ? __pfx_genl_rcv_msg+0x10/0x10\n   netlink_rcv_skb+0x54/0x100\n   genl_rcv+0x24/0x40\n   netlink_unicast+0x245/0x370\n   netlink_sendmsg+0x206/0x440\n   __sys_sendto+0x1dc/0x1f0\n   ? do_read_fault+0x10c/0x1d0\n   ? do_pte_missing+0x10d/0x190\n   __x64_sys_sendto+0x20/0x30\n   do_syscall_64+0x5c/0xf0\n   ? __count_memcg_events+0x4f/0xb0\n   ? mm_account_fault+0x6c/0x100\n   ? handle_mm_fault+0x116/0x270\n   ? do_user_addr_fault+0x1d6/0x6a0\n   ? do_syscall_64+0x6b/0xf0\n   ? clear_bhb_loop+0x25/0x80\n   ? clear_bhb_loop+0x25/0x80\n   ? clear_bhb_loop+0x25/0x80\n   ? clear_bhb_loop+0x25/0x80\n   ? clear_bhb_loop+0x25/0x80\n   entry_SYSCALL_64_after_hwframe+0x78/0x80",
  "id": "GHSA-pw6x-j3q8-6phw",
  "modified": "2024-10-23T15:31:03Z",
  "published": "2024-10-21T12:30:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47687"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5fe351def237df1ad29aa8af574350bc5340b4cf"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b6fbb1c7801f46a0e5461c02904eab0d7535c790"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/dc12502905b7a3de9097ea6b98870470c2921e09"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-8654"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-908"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-10T14:15:13Z",
    "severity": "MODERATE"
  },
  "details": "MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are called in internal aggregation stage. This issue affected MongoDB Server v6.0 version 6.0.3.",
  "id": "GHSA-pw8j-vg82-pm6c",
  "modified": "2025-05-17T00:30:25Z",
  "published": "2024-09-10T15:31:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8654"
    },
    {
      "type": "WEB",
      "url": "https://jira.mongodb.org/browse/SERVER-71477"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20250516-0008"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-6982"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-908"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-12-04T14:29:00Z",
    "severity": "MODERATE"
  },
  "details": "VMware ESXi 6.7 without ESXi670-201811401-BG and VMware ESXi 6.5 without ESXi650-201811301-BG contain uninitialized stack memory usage in the vmxnet3 virtual network adapter which may lead to an information leak from host to guest.",
  "id": "GHSA-pwjr-88cq-mmr3",
  "modified": "2022-05-13T01:04:00Z",
  "published": "2022-05-13T01:04:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-6982"
    },
    {
      "type": "WEB",
      "url": "https://www.vmware.com/security/advisories/VMSA-2018-0027.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/105882"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1042055"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-43458"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-908"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-10T17:15:33Z",
    "severity": "HIGH"
  },
  "details": "Windows Networking Information Disclosure Vulnerability",
  "id": "GHSA-px24-vp7g-w3gw",
  "modified": "2024-09-10T18:30:46Z",
  "published": "2024-09-10T18:30:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43458"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43458"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-21288"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-908"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-14T18:15:50Z",
    "severity": "MODERATE"
  },
  "details": "Windows COM Server Information Disclosure Vulnerability",
  "id": "GHSA-pxf8-r239-8j9j",
  "modified": "2025-01-14T18:32:04Z",
  "published": "2025-01-14T18:32:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21288"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21288"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-87456"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-908"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-09T01:17:01Z",
    "severity": "LOW"
  },
  "details": "Uninitialized resource in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)",
  "id": "GHSA-pxhj-hr63-ggvw",
  "modified": "2026-09-09T21:31:35Z",
  "published": "2026-09-09T03:30:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87456"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/496231550"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}