CVE-2026-19212
WonderTrader TraderATP Cash Trade Conversion WTSTradeDef.hpp uninitialized variable
- State
- Published
- Severity
- 5.3 Medium
- Published
- Aug 7, 2026
- Updated
- Aug 8, 2026
- Reserved
- Aug 7, 2026
Description
A vulnerability was determined in WonderTrader up to 0.9.9. This impacts an unknown function of the file src/Includes/WTSTradeDef.hpp of the component TraderATP Cash Trade Conversion. Executing a manipulation of the argument m_offsetType can lead to use of uninitialized variable. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 4.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 4.0 Medium | AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
WonderTradern/a |
|
References
- VDB-386957 | WonderTrader TraderATP Cash Trade Conversion WTSTradeDef.hpp uninitialized variablevdb-entrytechnical-description
- VDB-386957 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-19212 | CVE Analysis and Reportthird-party-advisory
- Submit #864875 | GitHub wondertrader 0.9.9 Use of Uninitialized Variablethird-party-advisory
- https://my.feishu.cn/wiki/PyAuwg8Bwit3TBk5DgLc14Ghnkb?from=from_copylinkexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.