CWE-908 对未经初始化资源的使用 类弱点 290 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-908 属于资源使用不当漏洞，指程序访问或操作未初始化的资源。攻击者通常利用此缺陷触发程序崩溃、非法内存访问或引发不可预期的异常行为，进而可能导致拒绝服务或进一步利用。开发者应避免此类问题，需在访问资源前确保其已完成正确的初始化流程，并增加对资源状态的严格检查与错误处理机制，以保障系统的稳定性与安全性。
private boolean initialized = true; public void someMethod() { if (!initialized) { // perform initialization tasks ... initialized = true; }$username = GetCurrentUser(); $state = GetStateData($username); if (defined($state)) { $uid = ExtractUserID($state); } # do stuff if ($uid == 0) { DoAdminThings(); }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-109438 | 3proxy 0.9.7 - 1.0.1 Uninitialized Stack Memory Disclosure via SOCKS4 — 3proxy | 5.3 | Medium | 2026-10-14 |
| CVE-2026-97629 | NGINX ngx_http_ssl_module vulnerability — NGINX Plus | 6.5 | Medium | 2026-10-14 |
| CVE-2026-104086 | 7-Zip < 26.03 SquashFS Uninitialized Memory Disclosure via UID/GID Table — 7-Zip | 5.5 | Medium | 2026-10-14 |
| CVE-2026-102187 | Windows内核信息泄露漏洞 — Windows 10 Version 1607 | 5.5 | Medium | 2026-10-13 |
| CVE-2026-97011 | Microsoft Office Excel 远程代码执行漏洞 — Microsoft 365 Apps for Enterprise | 8.8 | High | 2026-10-13 |
| CVE-2026-96850 | Windows 现代设备管理 (MDM) 信息泄露漏洞 — Windows 10 Version 1809 | 5.5 | Medium | 2026-10-13 |
| CVE-2026-96206 | Windows Subsystem for Linux 信息泄露漏洞 — Windows Subsystem for Linux (WSL2) | 6.5 | Medium | 2026-10-13 |
| CVE-2026-83925 | Windows内核信息泄露漏洞 — Windows 10 Version 1607 | 4.7 | Medium | 2026-10-13 |
| CVE-2026-83755 | win32k 信息泄露漏洞 — Windows 10 Version 1607 | 5.5 | Medium | 2026-10-13 |
| CVE-2026-83714 | HTTP.sys 信息泄露漏洞 — Windows 10 Version 1607 | 5.5 | Medium | 2026-10-13 |
| CVE-2026-83695 | Windows 事件日志服务信息泄露漏洞 — Windows 10 Version 1607 | 5.5 | Medium | 2026-10-13 |
| CVE-2026-70293 | Win32k 信息泄露漏洞 — Windows 10 Version 1607 | 5.5 | Medium | 2026-10-13 |
| CVE-2026-96849 | Windows 内核模式驱动程序信息泄露漏洞 — Windows 11 version 26H1 | 5.5 | Medium | 2026-10-13 |
| CVE-2026-96247 | Windows 内核模式驱动程序信息泄露漏洞 — Windows 10 Version 1607 | 5.5 | Medium | 2026-10-13 |
| CVE-2026-88150 | Microsoft Office Word远程代码执行漏洞 — Microsoft 365 Apps for Enterprise | 8.8 | High | 2026-10-13 |
| CVE-2026-85843 | Windows BITS 提权漏洞 — Windows 10 Version 1607 | 7.8 | High | 2026-10-13 |
| CVE-2026-85322 | Windows RRAS 信息泄露漏洞 — Windows 10 Version 1607 | 7.5 | High | 2026-10-13 |
| CVE-2026-85320 | Windows Print Spooler 组件信息泄露漏洞 — Windows 10 Version 1607 | 5.5 | Medium | 2026-10-13 |
| CVE-2026-83723 | Windows事件日志服务信息泄露漏洞 — Windows 10 Version 1607 | 5.5 | Medium | 2026-10-13 |
| CVE-2026-83669 | Windows Error Reporting 提权漏洞 — Windows 10 Version 1607 | 7.8 | High | 2026-10-13 |
| CVE-2026-83515 | RPC运行时信息泄露漏洞 — Windows 10 Version 1607 | 6.5 | Medium | 2026-10-13 |
| CVE-2026-70284 | Win32k 信息泄露漏洞 — Windows 10 Version 1607 | 5.5 | Medium | 2026-10-13 |
| CVE-2026-70090 | Windows Netlogon 信息泄露漏洞 — Windows 10 Version 1607 | 5.5 | Medium | 2026-10-13 |
| CVE-2026-105731 | Microsoft Office 图形组件信息泄露漏洞 — Microsoft Office for Android | 5.5 | Medium | 2026-10-13 |
| CVE-2026-109273 | ImageMagick 6.9.13-57前及7.1.2-32前PostScript解码器信息泄露漏洞 — ImageMagick | 5.3 | Medium | 2026-10-12 |
| CVE-2026-109242 | FreeRDP 远程内存信息泄露漏洞 — FreeRDP | 7.1 | High | 2026-10-12 |
| CVE-2026-107676 | FFmpeg 9.0.2 之前版本 HDR10+ 元数据序列化导致未初始化内存泄露漏洞 — FFmpeg | 3.3 | Low | 2026-10-08 |
| CVE-2026-104074 | Coturn 4.10.0 错误码导致的未初始化栈内存泄露漏洞 — coturn | 5.3 | Medium | 2026-10-07 |
| CVE-2026-106275 | Chrome Android<155.0.8059.39内存越界漏洞 — Chrome | - | - | 2026-10-06 |
| CVE-2026-106386 | Chrome <155.0.8059.39 内存越界读取漏洞 — Chrome | - | - | 2026-10-06 |
CWE-908（对未经初始化资源的使用） 是常见的弱点类别，本平台收录该类弱点关联的 290 条 CVE 漏洞。