CVE-2026-67648 is a vulnerability in Microsoft SQL Server 2017 (CU 31) involving the use of an uninitialized resource. This flaw allows an authorized attacker to disclose information over a network. The vulnerability has a medium severity rating with a CVSS score of 6.5. Official fixes have been released by Microsoft for affected versions.
CVE-2026-67386 is a vulnerability in Microsoft SQL Server 2017 (CU 31) involving the use of an uninitialized resource. This flaw allows an authorized attacker to disclose information over a network. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. Official fixes have been released for multiple affected versions.
CVE-2026-85880 is a heap-based buffer overflow vulnerability in the Windows ALPC component affecting multiple versions of Microsoft Windows 10 including Version 1607. An authorized local attacker can exploit this flaw to elevate privileges. The vulnerability has a high severity score of 7.8 and has known exploits in the wild. Microsoft has released official fixes for all affected versions.
CVE-2026-70290 is a vulnerability in the Windows 10 Version 1607 Win32 Kernel Subsystem involving the use of an uninitialized resource. This flaw allows an authorized local attacker to disclose sensitive information. The issue affects multiple Windows 10 builds prior to specific fixed versions. Microsoft has released official fixes for the affected versions.
CVE-2026-72945 is a vulnerability in Microsoft Windows 10 Version 1607 involving the use of an uninitialized resource in the Windows Task Scheduler. This flaw allows an authorized local attacker to disclose sensitive information. The vulnerability has a medium severity rating with a CVSS score of 5.5. Microsoft has issued official fixes for affected versions.
CVE-2026-69770 is a vulnerability in Microsoft Windows 10 Version 1607 and related builds involving the use of an uninitialized resource in the Spaceport.sys component. This flaw allows an authorized local attacker to disclose information. The vulnerability has a medium severity with a CVSS score of 5.5. Official patches have been released to address this issue across multiple affected Windows 10 versions.
CVE-2026-69485 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 involving the use of an uninitialized resource in the Remote Desktop Client. This flaw allows an authorized attacker to execute code remotely over a network. The vulnerability affects multiple Windows 10 builds prior to their respective fixed versions. Microsoft has released official patches to address this issue.
CVE-2026-69349 is a vulnerability in Microsoft Windows 10 Version 1607 involving the use of an uninitialized resource in Windows Management Instrumentation (WMI). This flaw allows an authorized attacker to disclose information over a network. The issue affects multiple Windows 10 builds prior to specific fixed versions. A patch is available and has been officially released by Microsoft.
CVE-2026-84267 is a vulnerability in the SFTP backend of GNOME gvfs where a malicious SFTP server can cause the client to use uninitialized heap memory as a file handle. This leads to information disclosure of the heap base and libgio library load address, defeating ASLR. Exploitation requires a user to connect to a malicious SFTP share. The impact is limited to information disclosure without exposing user data. A fix is available in gvfs version 1.60.2.
A vulnerability in the PyOpenEXR Python bindings of the AcademySoftwareFoundation's OpenEXR library allows exposure of uninitialized heap data when reading crafted deep scanline EXR files with layer-prefixed RGB channels. This occurs in versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13. The issue results from incorrect lane-offset calculations that cause some channel data to be uninitialized and returned, potentially exposing sensitive same-process heap contents. The flaw is fixed in versions 3.3.13 and 3.4.14.
CVE-2026-19448 is a stack memory corruption vulnerability in the IPsec ESP decapsulation handler of IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1. Exploiting this flaw can corrupt kernel stack state and cause a system crash, resulting in denial of service. The vulnerability is classified under CWE-908 (Use of Uninitialized Resource) and has a CVSS v3.1 base score of 6.5 (medium severity). No public exploits or patches are currently documented.
CVE-2026-63381 is a use-after-free vulnerability in libevent prior to versions 2.1.13 and 2.2.2-alpha. The flaw occurs in buffer.c when evbuffer_add_buffer_reference processes an output buffer with zero length, leading to dereferencing a freed chain pointer. This can cause memory corruption or process crashes. The issue is fixed in libevent versions 2.1.13 and 2.2.2-alpha.
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to the use of an uninitialized stack pointer.
CVE-2026-58084 is a vulnerability in FreeBSD 15.0-RELEASE and 15.1-RELEASE where the kernel fails to check for errors when retrieving the previous timer value for CLOCK_TAI timers. This leads to copying uninitialized kernel stack memory to userspace, allowing an unprivileged local user to potentially disclose sensitive kernel data.
CVE-2026-49425 is a vulnerability in FreeBSD's compat32 kevent() handler where a 64-bit kevent struct is translated into a 32-bit struct on the stack without zeroing it first. This leads to the potential exposure of uninitialized kernel stack data to unprivileged users, which may contain sensitive information. The flaw affects FreeBSD versions 14.3-RELEASE, 14.4-RELEASE, and 15.0-RELEASE. The vulnerability has a medium severity with a CVSS score of 5.5.
CVE-2026-49424 is a vulnerability in FreeBSD where the Linux waitid() implementation translates a FreeBSD siginfo_t struct into a Linux siginfo_t on the stack without zeroing the stack memory first. This results in an uninitialized resource use, allowing an unprivileged user to potentially observe 104 bytes of kernel stack data that may contain sensitive information.
CVE-2026-49423 is a vulnerability in FreeBSD's kernel TLS implementation where uninitialized iovec array entries can be read during HMAC computation. This occurs due to improper handling of mbufs containing only TLS header bytes in ktls_ocf_tls_cbc_decrypt(). A remote TLS peer can trigger a kernel panic by controlling TCP segmentation to cause this condition.
A reachable assertion vulnerability exists in libheif versions 1.23.0 and earlier. When processing crafted HEIF sequences via heif_context_read_from_memory(), the context may end up with no registered sequence tracks, causing a crash when heif_context_get_track(ctx, 0) is called. This occurs because an assertion in get_track() aborts in debug builds, while release builds dereference an empty map leading to undefined behavior and typical crashes. The issue is fixed in version 1.23.1.
CVE-2026-16868 is a high-severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It involves the use of uninitialized memory during ASN.1 length processing, which could allow a remote attacker to cause a denial of service. The vulnerability is related to CWE-908 (Use of Uninitialized Resource). No official patch or remediation guidance is currently available.
Rsync versions 3.0.0 through 3.4.4 contain a vulnerability where the daemon child process dereferences a null or uninitialized pointer when processing a specially crafted file list. This occurs if the first file list entry is a dot entry not typed as a directory, causing the daemon to crash and terminate the client connection.