CWE-456: Missing Initialization of a Variable
Description
The product does not initialize critical variables, which causes the execution environment to use unexpected values.
- Abstraction
- VariantA weakness tied to a specific language, technology or resource.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Draft
Common consequences
- IntegrityOther
Unexpected State; Quality Degradation; Varies by Context
The uninitialized data may be invalid, causing logic errors within the program. In some cases, this could result in a security problem.
Potential mitigations
- ImplementationAttack Surface Reduction
Ensure that critical variables are initialized before first use.
- RequirementsLanguage Selection
Choose a language that is not susceptible to these issues.
Related weaknesses
Parent weaknesses
Can lead to
- CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
- CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
- CWE-98Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
- CWE-457Use of Uninitialized Variable
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.