PT-2026-81634

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 152.0.7977.65 Description An uninitialized resource in the GPU allows a remote attacker to read memory outside the sandbox by using a crafted HTML page. Recommendations Update Google Chrome on Android...

PT-2026-81829

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description An uninitialized resource in ANGLE Almost Native Graphics Layer Engine, a compatibility layer that allows OpenGL ES APIs to run on non-native platforms allows a remote attacker to read...

PT-2026-81480

Name of the Vulnerable Software and Affected Versions OpenEXR versions 3.3.0 through 3.3.12 OpenEXR versions 3.4.0 through 3.4.13 Description The PyOpenEXR Python bindings return stale heap data when reading a specially crafted deep scanline EXR file that utilizes layer-prefixed RGB channels. Whe...

The vulnerability of the process_sdp() function in the net/netfilter/nf_conntrack_sip.c module of the netfilter component of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the processsdp function in the net/netfilter/nfconntracksip.c module of the netfilter component in the Linux operating system’s kernel is related to the access to an uninitialized pointer. Exploiting this vulnerability could allow an attacker to compromise the confidentiality...

PT-2026-81700

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description An uninitialized resource in ANGLE, a graphics abstraction layer, allows a remote attacker to potentially obtain cross-origin data by using a crafted HTML page. Recommendations Update...

nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module

A vulnerability in the NGINX ngxhttpslicemodule allows remote, unauthenticated attackers to access uninitialized memory via crafted requests. If configured with unnamed regex captures or background cache updates, this flaw can result in limited memory disclosure or a denial-of-service crash...

nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module

A vulnerability in the NGINX ngxhttpslicemodule allows remote, unauthenticated attackers to access uninitialized memory via crafted requests. If configured with unnamed regex captures or background cache updates, this flaw can result in limited memory disclosure or a denial-of-service crash...

CVE-2026-74670

A flaw was found in the Linux kernel's IP Virtual Server IPVS component. During the initial setup of the IPVS estimator, if the network namespace is removed, the estimator may continue operating with uninitialized limits. This can lead to an out-of-bounds write when processing network statistics,...

CVE-2026-74659

A flaw was found in the Linux kernel's Multiple Registration Protocol MRP bridge module. When constructing MRP test frames, the brmrpalloctestskb function fails to properly initialize certain fields. This oversight results in three uninitialized bytes being transmitted in every MRA MRPTest frame,...

CVE-2026-74617

A flaw was found in the Linux kernel's dibs device driver. The dibs-lock was not properly initialized when a dibs device was allocated, allowing a Global ID GID event interrupt to occur before the lock was ready. This could lead to the system attempting to acquire an uninitialized lock, potential...

CVE-2026-74602

A flaw was found in the Linux kernel's ring-buffer component. The rballocatecpubuffer function failed to initialize the bpage-order value, leaving it as zero. This uninitialized value is later used by freebufferpage when deallocating ring-buffers with sub-buffers larger than a page size. An...

CVE-2026-74673

A flaw was found in the Linux kernel's evdev component. This vulnerability occurs because certain data structures, specifically inputevent, are not fully cleared before being sent to user applications. This can result in uninitialized memory from the kernel's internal stack being exposed to an...

Astra Linux – Vulnerability in libstb

stbimage is a single-file library licensed under MIT, used for processing images. If stbiloadgifmain in stbiloadgiffrommemory fails, it returns a null pointer and may leave the z variable uninitialized. If the caller also sets the vertical flipping flag, the process continues by calling...

Astra Linux – Vulnerability in libslirp

An invalid pointer initialization issue was discovered in the SLiRP networking implementation of QEMU. The flaw resides in the bootpinput function and can occur when processing an UDP packet that is smaller than the size of the ‘bootpt’ structure. A malicious guest could exploit this flaw to leak...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: virtio/vsock: Fixed an uninit-value issue in virtiotransportrecvpkt KMSAN reported the following uninit-value access issues: ===================================================== BUG: KMSAN: uninit-value in...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: usb: idmouse: Fixed an issue where an uninitialized value was present in idmouseopen. In idmousecreateimage, if any ftipcommand fails, it will proceed to the reset label. However, this results in the data in...

Astra Linux – Vulnerability in Qemu

An information disclosure vulnerability was discovered in the virtio vhost-user GPU device vhost-user-gpu of QEMU in versions up to and including 6.0. The flaw resides in the virglcmdgetcapsetinfo function in contrib/vhost-user-gpu/virgl.c, and can occur due to the reading of uninitialized memory...

Astra Linux – Vulnerability in Firefox and Thunderbird

When resolving a symbolic link such as file:///proc/self/fd/1, an error message may be generated if the symbolic link resolves to a string containing uninitialized memory in the buffer. This bug only affects Thunderbird on Unix-based operating systems Android, Linux, MacOS. Windows is unaffected...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: UDF: Fixed uninitialized array access for some pathnames For filenames that start with . and are between 2 and 5 characters long, the UDF charset conversion code would read uninitialized memory from the output buffer. The only...

Astra Linux – Vulnerability in binutils

There is a flaw in binutils /opcodes/tic4x-dis.c. An attacker who can submit a crafted input file for processing by binutils could cause the use of uninitialized memory. The greatest threat is to the availability of the application, with a lower threat to data confidentiality. This flaw affects...