Weaknesses of type CWE-190

1,657 results

Estouro ou envolvimento de inteiro

Ocorre quando uma operação aritmética produz um resultado maior (ou menor, em caso de sinal) do que o tipo de dado consegue representar, causando truncamento ou envolvimento para valores inesperados. Um atacante explora isso para contornar validações, causar alocações de memória inválidas ou alterar lógica de negócio.

Example

Um servidor calcula tamanho de buffer como `size = quantidade * 100`. Se quantidade for próxima ao máximo de um inteiro de 32 bits, a multiplicação estoura e retorna um valor pequeno, levando a alocação insuficiente e buffer overflow posterior.

How to mitigate

Valide limites antes de operações aritméticas (verifique se o resultado cabe no tipo), use tipos de dado maiores quando possível, ou aplique bibliotecas de aritmética segura que detectam estouro em tempo de execução.

CVE-2023-40474HIGHGStreamer MXF File Parsing Integer Overflow Remote Code Execution VulnerabilityEPSS 1.9%CVE-2023-40475HIGHGStreamer MXF File Parsing Integer Overflow Remote Code Execution VulnerabilityEPSS 1.9%CVE-2026-7838HIGHUltraVNC viewer heap buffer overflow via integer overflow in RFB connection-failure reason lengthEPSS 1.9%CVE-2021-27435HIGHARM mbed Integer Overflow or WraparoundEPSS 1.9%CVE-2021-3475—There is a flaw in OpenEXR in versions before 3.0.0-beta. An attacker who can submit a crafted file to be processed by OpenEXR could cause aEPSS 1.8%CVE-2021-3476—A flaw was found in OpenEXR's B44 uncompression functionality in versions before 3.0.0-beta. An attacker who is able to submit a crafted filEPSS 1.8%CVE-2021-3474—There's a flaw in OpenEXR in versions before 3.0.0-beta. A crafted input file that is processed by OpenEXR could cause a shift overflow in tEPSS 1.8%CVE-2024-1580MEDIUMInteger overflow in VideoLAN dav1dEPSS 1.8%CVE-2025-21172HIGH.NET and Visual Studio Remote Code Execution VulnerabilityEPSS 1.8%CVE-2026-8631CRITICALHP Linux Imaging and Printing Software – Potential Escalation of Privilege and Arbitrary Code ExecutionEPSS 1.8%CVE-2024-21372HIGHWindows OLE Remote Code Execution VulnerabilityEPSS 1.8%CVE-2020-10063MEDIUMRemote Denial of Service in CoAP Option Parsing Due To Integer OverflowEPSS 1.8%CVE-2021-21704MEDIUMMultiple vulnerabilities in Firebird client extensionEPSS 1.8%CVE-2021-22156CRITICALAn integer overflow vulnerability in the calloc() function of the C runtime library of affected versions of BlackBerry® QNX Software DevelopEPSS 1.8%CVE-2024-21428HIGHSQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityEPSS 1.8%CVE-2022-24354HIGHThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link AC1750 prior to 1.1.4 BuEPSS 1.8%CVE-2021-27433HIGHARM mbed-ualloc memory library Integer Overflow or WraparoundEPSS 1.8%CVE-2024-38019HIGHMicrosoft Windows Performance Data Helper Library Remote Code Execution VulnerabilityEPSS 1.8%CVE-2023-21803CRITICALWindows iSCSI Discovery Service Remote Code Execution VulnerabilityEPSS 1.8%CVE-2024-21812CRITICALAn integer overflow vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0eEPSS 1.8%