cve-2016-0040

cve-2016-0040 poc for cve-2016-0040 bug found and exploited by Meysam Firozi @R00tkitSmm this poc help write arbitrary data to arbitrary address in windows kernel for more info see ny blog : http://ioctl.ir/index.php/2016/02/13/cve-2016-0040-story-of-uninitialized-pointer/...

CVE-2022-21971

CVE-2022-21971: Uninitialized pointer free in prauthproviders Root-cause The WapAuthProvider::CreateInstance constructor allocates and initializes a WapAuthProvider object 0x78 bytes but it fails to initialize completely its state. The pointer at offset 0x50 is uninitialized and free'd when the...

CVE-2026-98841

A flaw was found in the Linux kernel's Virtual Machine Generation ID vmgenid driver. The driver registers interrupt and notification handlers before fully initializing driver data during startup. If an interrupt or notification is received immediately—such as when restoring a virtual machine from...

CVE-2022-21971-Windows-Runtime-RCE

CVE-2022-21971: Uninitialized pointer free in prauthproviders Root-cause The WapAuthProvider::CreateInstance constructor allocates and initializes a WapAuthProvider object 0x78 bytes but it fails to initialize completely its state. The pointer at offset 0x50 is uninitialized and free'd when the...

CVE-2026-115327

A flaw was found in libyang. An uninitialized pointer free vulnerability occurs during the processing of Network Configuration Protocol NETCONF Remote Procedure Call RPC action envelopes. An authenticated remote attacker with an established NETCONF session can trigger this flaw by sending a...

CVE-2022-21974

CVE-2022-21974: Unitialized pointer free in RMSRoamingSecurity Remote Code Execution Root-cause The RMSRoamingSecurity!ATL::CComCreator ::CreateInstance constructor allocates and initializes a CRmsRoamingSecurity object 0x3470 bytes but it fails to initialize completely its state. For example, at...

DEBIAN-CVE-2026-115327

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxmlenvnetconfrpc in src/parserxml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lydparseop to crash servers like netopeer2 or...

CVE-2026-115327

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxmlenvnetconfrpc in src/parserxml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lydparseop to crash servers like netopeer2 or...

CVE-2026-115327 libyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC Parser

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxmlenvnetconfrpc in src/parserxml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lydparseop to crash servers like netopeer2 or...

EUVD-2026-108129

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxmlenvnetconfrpc in src/parserxml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lydparseop to crash servers like netopeer2 or...

CVE-2026-115327

The libyang library (versions through 6.4.13 ) is vulnerable to an uninitialized pointer free vulnerability within the lydxml_env_netconf_rpc() function located in src/parser_xml.c. This issue occurs during the parsing of NETCONF RPC action envelopes . An attacker with an established NETCONF sess...

CVE-2026-115327 libyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC Parser

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxmlenvnetconfrpc in src/parserxml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lydparseop to crash servers like netopeer2 or...

PT-2026-121365

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml env netconf rpc in src/parser xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd parse op to crash servers like...

CVE-2026-94018 NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow path

The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a Content-Length underflow while processing a PUT request. The condition is reachable by an unauthenticated remote client with a single malformed request...

CVE-2026-94018 NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow path

The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a Content-Length underflow while processing a PUT request. The condition is reachable by an unauthenticated remote client with a single malformed request...

CVE-2026-94018

The NetX Duo Web HTTP server is vulnerable to a memory safety issue where it dereferences and releases an uninitialized pointer . This occurs when the server detects a Content-Length underflow while processing a PUT request. An unauthenticated remote client can trigger this condition by sending a...

CVE-2026-90430

A flaw was found in the Linux kernel's iommu/tegra241-cmdqv component. A local attacker could potentially trigger a system crash, leading to a Denial of Service DoS. This occurs because a pointer to a command queue vcmdq is stored before it is fully initialized. If an error is encountered during...

Siemens SIMATIC S7-1500 TM MFP Access of Uninitialized Pointer (CVE-2026-23367)

In the Linux kernel, the following vulnerability has been resolved: wifi: radiotap: reject radiotap with unknown bits The radiotap parser is currently only used with the radiotap namespace not with vendor namespaces, but if the undefined field 18 is used, the alignment/size is unknown as well. In...

CVE-2022-21971

CVE-2022-21971: Uninitialized pointer free in prauthproviders Root-cause The WapAuthProvider::CreateInstance constructor allocates and initializes a WapAuthProvider object 0x78 bytes but it fails to initialize completely its state. The pointer at offset 0x50 is uninitialized and free'd when the...

SUSE CVE-2026-86847

A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails, causing the host vhost-crypto process to hang or crash...