CVE-2026-19212
Received Received - Intake

Use of Uninitialized Variable in WonderTrader TraderATP Cash Trade Conversion

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: VulDB

Description
A vulnerability was determined in WonderTrader up to 0.9.9. This impacts an unknown function of the file src/Includes/WTSTradeDef.hpp of the component TraderATP Cash Trade Conversion. Executing a manipulation of the argument m_offsetType can lead to use of uninitialized variable. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-19212
EUVD
EUVD-2026-54525

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wondertrader wondertrader to 0.9.9 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-457 The code uses a variable that has not been initialized, leading to unpredictable or unintended results.
CWE-453 The product, by default, initializes an internal variable with an insecure or less secure value than is possible.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in WonderTrader versions up to 0.9.9, specifically in the TraderATP Cash Trade Conversion component. It involves an uninitialized variable issue triggered by manipulating the m_offsetType argument in the file src/Includes/WTSTradeDef.hpp. This can lead to undefined behavior when the variable is used.

Detection Guidance

Detection of this vulnerability requires checking for uninitialized variable usage in WonderTrader versions up to 0.9.9. Inspect the file src/Includes/WTSTradeDef.hpp for improper handling of the m_offsetType argument. No specific commands are provided in the context.

Impact Analysis

The vulnerability can be exploited remotely, potentially causing crashes or unexpected behavior in the affected software. Since it involves an uninitialized variable, it may lead to data corruption or incorrect processing of trades, depending on how the software uses the variable.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it involves a use-of-uninitialized-variable issue in a trading software component with low CVSS scores (2.1 to 4.3). No evidence suggests exposure of personal or sensitive data.

Mitigation Strategies

Upgrade WonderTrader to a version beyond 0.9.9 where the vulnerability is patched. If no patch is available, disable the TraderATP Cash Trade Conversion component or restrict access to the vulnerable function in src/Includes/WTSTradeDef.hpp.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19212. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart