Weaknesses of type CWE-190

1,658 results

Estouro ou envolvimento de inteiro

Ocorre quando uma operação aritmética produz um resultado maior (ou menor, em caso de sinal) do que o tipo de dado consegue representar, causando truncamento ou envolvimento para valores inesperados. Um atacante explora isso para contornar validações, causar alocações de memória inválidas ou alterar lógica de negócio.

Example

Um servidor calcula tamanho de buffer como `size = quantidade * 100`. Se quantidade for próxima ao máximo de um inteiro de 32 bits, a multiplicação estoura e retorna um valor pequeno, levando a alocação insuficiente e buffer overflow posterior.

How to mitigate

Valide limites antes de operações aritméticas (verifique se o resultado cabe no tipo), use tipos de dado maiores quando possível, ou aplique bibliotecas de aritmética segura que detectam estouro em tempo de execução.

CVE-2025-47268MEDIUMping in iputils before 20250602 allows a denial of service (application error or incorrect data collection) via a crafted ICMP Echo Reply paEPSS 1.7%CVE-2021-43784MEDIUMOverflow in netlink bytemsg length field allows attacker to override netlink-based container configurationEPSS 1.7%CVE-2022-3515CRITICALA vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remoteEPSS 1.6%CVE-2020-3120HIGHCisco FXOS, IOS XR, and NX-OS Software Cisco Discovery Protocol Denial of Service VulnerabilityEPSS 1.6%CVE-2024-38128HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.6%CVE-2023-6478HIGHXorg-x11-server: out-of-bounds memory read in rrchangeoutputproperty and rrchangeproviderpropertyEPSS 1.6%CVE-2024-43628HIGHWindows Telephony Service Remote Code Execution VulnerabilityEPSS 1.6%CVE-2024-37323HIGHSQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityEPSS 1.6%CVE-2024-49085HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.6%CVE-2024-43635HIGHWindows Telephony Service Remote Code Execution VulnerabilityEPSS 1.6%CVE-2025-54957CRITICALAn issue was discovered in Dolby UDC 4.5 through 4.13. A crash of the DD+ decoder process can occur when a malformed DD+ bitstream is procesEPSS 1.6%CVE-2022-28331CRITICALApache Portable Runtime (APR): Windows out-of-bounds write in apr_socket_sendv functionEPSS 1.6%CVE-2021-27665HIGHexacqVision Server 32-bitEPSS 1.6%CVE-2024-4453HIGHGStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution VulnerabilityEPSS 1.6%CVE-2021-22680HIGHNXP MQX Integer Overflow or WraparoundEPSS 1.6%CVE-2021-27439HIGHTencentOS-tiny Integer Overflow or WraparoundEPSS 1.6%CVE-2022-47629CRITICALLibksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser.EPSS 1.6%CVE-2008-4036HIGHInteger overflow in Memory Manager in Microsoft Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows EPSS 1.5%CVE-2022-2831—A flaw was found in Blender 3.3.0. An interger overflow in source/blender/blendthumb/src/blendthumb_extract.cc may lead to program crash or EPSS 1.5%CVE-2023-38103HIGHGStreamer RealMedia File Parsing Integer Overflow Remote Code Execution VulnerabilityEPSS 1.5%