CWE-908 vulnerabilities

Use of uninitialized resource in Windows Subsystem for Linux allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows HTTP.sys allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Use of uninitialized resource in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.

Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.

Use of uninitialized resource in Windows Print Spooler Components allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

Use of uninitialized resource in RPC Runtime allows an unauthorized attacker to disclose information over a network.

Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Netlogon allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Microsoft Graphics Component allows an authorized attacker to disclose information locally.

ImageMagick versions before 6.9.13-57 and 7.x before 7.1.2-32 have an information disclosure vulnerability in the PostScript decoder. This flaw arises because the decoder allocates a buffer one byte longer than the decoded data, potentially exposing an uninitialized byte of memory. An attacker can exploit this by supplying a crafted PostScript file to leak memory contents.

CVE-2026-109242 is a use of uninitialized resource vulnerability in FreeRDP versions before 3.0.0 and 3.6.0 before 3.32.0. The flaw occurs because the tile->current buffer is allocated without zeroing, causing uninitialized heap memory from un-decoded progressive tiles to be rendered. A malicious RDP server can exploit this by sending a crafted WBT_TILE_FIRST then WBT_TILE_UPGRADE sequence, potentially causing heap bytes to be painted onscreen or aborting the client process.