# Premature length uninitialized memory disclosure

Length or size set before the write, or requested size used instead of bytes actually written

_Area: Memory corruption and native code. Seen in 10 disclosed reports; 2 confirmed bounties: $8,000 and $80,000; latest 2026-10-20. Updated 2026-10-23._

## How it works
A buffer is allocated and a length or size field is filled in before the code knows how much data it will actually write. When validation fails, an edge case is hit, or a short read occurs, the write never happens (or writes fewer bytes) but the length still claims the full amount. The caller then copies or serializes that many bytes, including whatever stale heap, stack or kernel memory the allocation reused. The broken assumption is that "allocated size" or "requested length" equals "bytes produced", and that a length field is only set once data is present.

## Where it shows up
- Response length assigned from an attacker-controlled field before the request opcode is validated, over an uninitialized malloc buffer [E1](https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2023-5-17-cve-2023-2086920870-exploiting-vmware-workstation-at-pwn2own-vancouver.md).
- Structures copied to userspace without zero-initialization, where an invalid combination of requested elements leaves a few bytes unwritten [E2](https://bugbountylibrary.com/r/p0%3ACVE-2020-27950.md).
- Length counters incremented by the original input length rather than the bytes actually written after truncation [E4](https://bugbountylibrary.com/r/h1%3A1223882.md).
- Consumers trusting a requested read length rather than the actual bytes returned by the read API [E3](https://bugbountylibrary.com/r/h1%3A1595290.md).
- Format-parsing return values checked for truthiness instead of exact field count, leaving destination buffers stale [E6](https://bugbountylibrary.com/r/h1%3A1176461.md).
- Short reads on attacker-controlled offsets where the error macro only logs a warning and execution continues on a partially-filled buffer [E7](https://bugbountylibrary.com/r/h1%3A160294.md)[E8](https://bugbountylibrary.com/r/h1%3A167888.md).

## How to review
Trace every length field to the write that fills it. The invariant: the length returned or serialized must be derived from bytes actually written, never from the allocation size, a pre-validation input, or a requested read size. Grep for length assignments that precede validation branches and confirm error/early-return paths do not leave a length set. For bucket/read APIs, use the returned data length, not the requested one [E3](https://bugbountylibrary.com/r/h1%3A1595290.md). For format parsing, compare the return value to the exact expected field count [E6](https://bugbountylibrary.com/r/h1%3A1176461.md). Check buffers and structs are zero-initialized or fully written before crossing a trust boundary [E2](https://bugbountylibrary.com/r/p0%3ACVE-2020-27950.md). Audit every error-logging macro call site for a missing early return before the buffer is used [E7](https://bugbountylibrary.com/r/h1%3A160294.md)[E8](https://bugbountylibrary.com/r/h1%3A167888.md).

## Variants seen
- Early size assignment plus uninitialized malloc in an emulated USB device handler [E1](https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2023-5-17-cve-2023-2086920870-exploiting-vmware-workstation-at-pwn2own-vancouver.md).
- Incorrect trailer size calculation leaving a few bytes unwritten in kernel memory [E2](https://bugbountylibrary.com/r/p0%3ACVE-2020-27950.md).
- Truncated write with length counter updated from input, not output [E4](https://bugbountylibrary.com/r/h1%3A1223882.md).
- Short bucket read copied at requested length [E3](https://bugbountylibrary.com/r/h1%3A1595290.md).
- sscanf partial match leaving stale destination bytes [E6](https://bugbountylibrary.com/r/h1%3A1176461.md).
- Non-fatal read-error macro continuing on a partially-filled buffer [E7](https://bugbountylibrary.com/r/h1%3A160294.md)[E8](https://bugbountylibrary.com/r/h1%3A167888.md).

## Why fixes fail
A fix for one truncation shape left the inverse shape (swap which field is long) still leaking [E4](https://bugbountylibrary.com/r/h1%3A1223882.md). Patches that address one field ordering can miss the mirror case; test the advisory's own example plus the inverse.

## Impact and severity
Leaked kernel pointers enabled an iOS exploit chain [E2](https://bugbountylibrary.com/r/p0%3ACVE-2020-27950.md), and stack contents leaked to a peer [E4](https://bugbountylibrary.com/r/h1%3A1223882.md)[E6](https://bugbountylibrary.com/r/h1%3A1176461.md). Severity rises when reachable pre-auth, when leaked data is serialized directly into a response, and when the leak is repeatable for heap grooming [E2](https://bugbountylibrary.com/r/p0%3ACVE-2020-27950.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2023-5-17-cve-2023-2086920870-exploiting-vmware-workstation-at-pwn2own-vancouver.md
- E2: https://bugbountylibrary.com/r/p0%3ACVE-2020-27950.md
- E3: https://bugbountylibrary.com/r/h1%3A1595290.md
- E4: https://bugbountylibrary.com/r/h1%3A1223882.md
- E5: https://bugbountylibrary.com/r/h1%3A184661.md
- E6: https://bugbountylibrary.com/r/h1%3A1176461.md
- E7: https://bugbountylibrary.com/r/h1%3A160294.md
- E8: https://bugbountylibrary.com/r/h1%3A167888.md