CWE · MITRE source
CWE-665Improper Initialization
The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
This can have security implications when the associated resource is expected to have certain properties or values, such as a variable that determines whether a user has been authenticated or not.
Last updated: 15 October 2026 07:26 UTC
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
NIST 800-53 r5 controls PROPOSED for this weakness (2)AI-assisted
These are model PROPOSALS, not graded mappings. They come
from controls_to_cwe_proposals, which carries no grade field at
all; across the CWE pages 1,540 of 1,722 such associations (89%) have never
been graded by anything. The heading said “address” until
2026-09-29, which asserted a relationship the data does not carry.
Graded cross-walks are on the framework map, not here.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
SC-4 | Information in Shared System Resources | SC | Ensures shared resources are explicitly initialized or cleared on allocation, preventing exposure of prior contents to new users or processes. |
SI-14 | Non-persistence | SI | Mandates that every instance begins in a known (presumably clean) state, eliminating reliance on residual or uninitialized state left by prior executions. |
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2022-46164 UPD | 9.0 | 9.4 | 0.4737 | 2022-12-05 |
CVE-2022-37128 UPD | 8.6 | 9.8 | 0.2171 | 2022-08-31 |
CVE-2019-14271 UPD | 8.5 | 9.8 | 0.1883 | 2019-07-29 |
CVE-2022-0847 KEV UPD | 8.5 | 7.8 | 0.9280 | 2022-03-10 |
CVE-2022-22719 UPD | 8.3 | 7.5 | 0.6910 | 2022-03-14 |
CVE-2008-0062 UPD | 8.2 | 9.8 | 0.1014 | 2008-03-19 |
CVE-2017-13715 UPD | 8.2 | 9.8 | 0.0965 | 2017-08-29 |
CVE-2020-28019 UPD | 8.2 | 7.5 | 0.6166 | 2021-05-06 |
CVE-2015-8367 UPD | 8.0 | 9.8 | 0.0560 | 2020-01-14 |
CVE-2019-3464 UPD | 7.9 | 9.8 | 0.0470 | 2019-02-06 |
CVE-2013-1675 KEV UPD | 7.7 | 6.5 | 0.0670 | 2013-05-16 |
CVE-2019-10196 UPD | 7.6 | 9.8 | 0.0139 | 2021-03-19 |
CVE-2021-41264 UPD | 7.6 | 9.8 | 0.0149 | 2021-11-12 |
CVE-2024-39864 UPD | 7.6 | 9.8 | 0.0177 | 2024-07-05 |
CVE-2018-11949 UPD | 7.5 | 9.8 | 0.0095 | 2019-05-24 |
CVE-2020-27950 KEV UPD | 7.5 | 5.5 | 0.1652 | 2020-12-08 |
CVE-2024-38558 UPD | 7.5 | 10.0 | 0.0082 | 2024-06-19 |
CVE-2026-64775 | 7.4 | 9.8 | 0.0066 | 2026-07-27 |
CVE-2001-1471 UPD | 7.3 | 8.8 | 0.0770 | 2001-07-31 |
CVE-2017-5468 UPD | 7.3 | 9.1 | 0.0244 | 2018-06-11 |
CVE-2021-33635 UPD | 7.3 | 9.8 | 0.0055 | 2023-10-29 |
CVE-2024-46697 UPD | 7.3 | 9.8 | 0.0042 | 2024-09-13 |
CVE-2008-3637 UPD | 7.2 | 8.8 | 0.0573 | 2008-09-26 |
CVE-2018-10484 UPD | 7.0 | 8.8 | 0.0264 | 2018-05-17 |
CVE-2018-14282 UPD | 7.0 | 8.8 | 0.0274 | 2018-07-31 |