Weaknesses of type CWE-190

1,660 results

Estouro ou envolvimento de inteiro

Ocorre quando uma operação aritmética produz um resultado maior (ou menor, em caso de sinal) do que o tipo de dado consegue representar, causando truncamento ou envolvimento para valores inesperados. Um atacante explora isso para contornar validações, causar alocações de memória inválidas ou alterar lógica de negócio.

Example

Um servidor calcula tamanho de buffer como `size = quantidade * 100`. Se quantidade for próxima ao máximo de um inteiro de 32 bits, a multiplicação estoura e retorna um valor pequeno, levando a alocação insuficiente e buffer overflow posterior.

How to mitigate

Valide limites antes de operações aritméticas (verifique se o resultado cabe no tipo), use tipos de dado maiores quando possível, ou aplique bibliotecas de aritmética segura que detectam estouro em tempo de execução.

CVE-2023-52339MEDIUMIn libebml before 1.4.5, an integer overflow in MemIOCallback.cpp can occur when reading or writing. It may result in buffer overflows.EPSS 1.1%CVE-2020-27769—In ImageMagick versions before 7.0.9-0, there are outside the range of representable values of type 'float' at MagickCore/quantize.c.EPSS 1.1%CVE-2020-27761—WritePALMImage() in /coders/palm.c used size_t casts in several areas of a calculation which could lead to values outside the range of repreEPSS 1.1%CVE-2022-21801HIGHA denial of service vulnerability exists in the netserver recv_command functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crEPSS 1.1%CVE-2020-27757—A floating point math calculation in ScaleAnyToQuantum() of /MagickCore/quantum-private.h could lead to undefined behavior in the form of a EPSS 1.1%CVE-2020-25675—In the CropImage() and CropImageToTiles() routines of MagickCore/transform.c, rounding calculations performed on unconstrained pixel offsetsEPSS 1.1%CVE-2022-1699CRITICALUncontrolled Resource Consumption in causefx/organizrEPSS 1.1%CVE-2024-22211LOWFreeRDP integer Overflow leading to Heap OverflowEPSS 1.1%CVE-2022-40983HIGHAn integer overflow vulnerability exists in the QML QtScript Reflect API of Qt Project Qt 6.3.2. A specially-crafted javascript code can triEPSS 1.1%CVE-2026-5121HIGHLibarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processingEPSS 1.1%CVE-2024-43566HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 1.1%CVE-2024-1916CRITICALInteger Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remEPSS 1.1%CVE-2024-1917CRITICALInteger Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remEPSS 1.1%CVE-2025-46819MEDIUMRedis is vulnerable to DoS via specially crafted LUA scriptsEPSS 1.1%CVE-2023-32307HIGHheap-over-flow and integer-overflow in sofia-sipEPSS 1.1%CVE-2026-69329HIGHBranchCache Denial of Service VulnerabilityEPSS 1.1%CVE-2024-0803CRITICALInteger Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remEPSS 1.0%CVE-2022-1718HIGHThe trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request in polonel/trudeskEPSS 1.0%CVE-2026-27784HIGHNGINX ngx_http_mp4_module vulnerabilityEPSS 1.0%CVE-2022-1754HIGHInteger Overflow or Wraparound in polonel/trudeskEPSS 1.0%