# Uninitialized struct field reachable from input

Fields read before init after removed init, skipped constructor mode, or parser mismatch leaving buffers unset

_Area: Memory corruption and native code. Seen in 7 disclosed reports; 5 confirmed bounties, median $8,000, range $2,000-$10,000; latest 2026-10-21. Updated 2026-10-23._

## How it works
Code assumes a struct or object field is populated before use, but some path skips that initialization: a removed init hook, an alternate constructor mode, a parser that ignores a header, or a decoder that accepts structurally incomplete input. The field then holds stale heap contents or NULL, and a later read or dereference turns attacker-influenced state into memory corruption or disclosure.

## Where it shows up
- Object lifecycle hooks (initialize_copy, dup, clone) that user script can remove or override, leaving native pointers NULL [E3](https://bugbountylibrary.com/r/h1%3A181685.md)[E6](https://bugbountylibrary.com/r/h1%3A184661.md)
- Alternate constructor modes (e.g. type=0) that skip field setup, then accept malformed parameter objects [E5](https://bugbountylibrary.com/r/h1%3A151040.md)
- Two parsers disagreeing on the same input (case-sensitive vs case-insensitive header match, duplicate headers), so a buffer is sized but never filled [E1](https://bugbountylibrary.com/r/h1%3A1070835.md)
- Decoders that render output when data blocks are missing, reading a reused buffer [E4](https://bugbountylibrary.com/r/blog%3Avulnano-com-2019-03-facebook-messenger-server-random-memory-html.md)
- Per-type fields in global kernel structures never initialized for some window/system classes [E2](https://bugbountylibrary.com/r/p0%3ACVE-2019-1458.md)

## How to review
For each field read, trace every path that can reach the read and confirm an initializer runs on all of them. The invariant: no field is dereferenced or copied unless its owning object was fully constructed. Check copy/dup methods for NULL checks on internal pointers [E6](https://bugbountylibrary.com/r/h1%3A184661.md), constructor variants for complete field setup [E5](https://bugbountylibrary.com/r/h1%3A151040.md), and any place two parsers consume the same bytes for agreement on length and presence [E1](https://bugbountylibrary.com/r/h1%3A1070835.md). For decoders, confirm missing-data cases zero or reject rather than emit buffer contents [E4](https://bugbountylibrary.com/r/blog%3Avulnano-com-2019-03-facebook-messenger-server-random-memory-html.md).

## Variants seen
- Removed init hook leaves object uninitialized, instance method null-derefs [E3](https://bugbountylibrary.com/r/h1%3A181685.md)
- Copy method dereferences NULL DATA_PTR after user overrides initialize [E6](https://bugbountylibrary.com/r/h1%3A184661.md)
- Constructor mode skips field init; unvalidated parameter triggers corruption [E5](https://bugbountylibrary.com/r/h1%3A151040.md)
- Parser mismatch leaves heap buffer uninitialized and written out [E1](https://bugbountylibrary.com/r/h1%3A1070835.md)
- Incomplete file causes decoder to expose stale memory as pixels [E4](https://bugbountylibrary.com/r/blog%3Avulnano-com-2019-03-facebook-messenger-server-random-memory-html.md)
- Uninitialized kernel struct field yields limited arbitrary write for EoP [E2](https://bugbountylibrary.com/r/p0%3ACVE-2019-1458.md)

## Why fixes fail
E2 notes the vendor patched only one system window type, leaving sibling FNID_* fields uninitialized, so the same class of bug persists elsewhere.

## Impact and severity
Range: sandbox crash to RCE (E1 chained info leak with OOB to hijack control flow), kernel EoP [E2](https://bugbountylibrary.com/r/p0%3ACVE-2019-1458.md), memory disclosure of prior buffer contents [E4](https://bugbountylibrary.com/r/blog%3Avulnano-com-2019-03-facebook-messenger-server-random-memory-html.md), and sandbox host crashes [E3](https://bugbountylibrary.com/r/h1%3A181685.md)[E6](https://bugbountylibrary.com/r/h1%3A184661.md). Severity rises when the uninitialized value is attacker-shaped (size, index) or chained with a second bug.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A1070835.md
- E2: https://bugbountylibrary.com/r/p0%3ACVE-2019-1458.md
- E3: https://bugbountylibrary.com/r/h1%3A181685.md
- E4: https://bugbountylibrary.com/r/blog%3Avulnano-com-2019-03-facebook-messenger-server-random-memory-html.md
- E5: https://bugbountylibrary.com/r/h1%3A151040.md
- E6: https://bugbountylibrary.com/r/h1%3A184661.md