Weaknesses of type CWE-190

1,660 results

Estouro ou envolvimento de inteiro

Ocorre quando uma operação aritmética produz um resultado maior (ou menor, em caso de sinal) do que o tipo de dado consegue representar, causando truncamento ou envolvimento para valores inesperados. Um atacante explora isso para contornar validações, causar alocações de memória inválidas ou alterar lógica de negócio.

Example

Um servidor calcula tamanho de buffer como `size = quantidade * 100`. Se quantidade for próxima ao máximo de um inteiro de 32 bits, a multiplicação estoura e retorna um valor pequeno, levando a alocação insuficiente e buffer overflow posterior.

How to mitigate

Valide limites antes de operações aritméticas (verifique se o resultado cabe no tipo), use tipos de dado maiores quando possível, ou aplique bibliotecas de aritmética segura que detectam estouro em tempo de execução.

CVE-2026-32952MEDIUMgo-ntlmssp NTLM challenges can panic on malformed payloadsEPSS 1.0%CVE-2023-36576MEDIUMWindows Kernel Information Disclosure VulnerabilityEPSS 1.0%CVE-2026-6473HIGHPostgreSQL server undersizes allocations, via integer wraparoundEPSS 1.0%CVE-2022-0961HIGHThe microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweberEPSS 1.0%CVE-2023-24908HIGHRemote Procedure Call Runtime Remote Code Execution VulnerabilityEPSS 1.0%CVE-2023-24869HIGHRemote Procedure Call Runtime Remote Code Execution VulnerabilityEPSS 1.0%CVE-2023-23405HIGHRemote Procedure Call Runtime Remote Code Execution VulnerabilityEPSS 1.0%CVE-2024-50944CRITICALInteger overflow vulnerability exists in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f in the shopping cart functionalityEPSS 1.0%CVE-2022-21154HIGHAn integer overflow vulnerability exists in the fltSaveCMP functionality of Leadtools 22. A specially-crafted BMP file can lead to an integeEPSS 1.0%CVE-2026-69408CRITICALMicrosoft Windows Media Foundation Remote Code Execution VulnerabilityEPSS 1.0%CVE-2026-35092HIGHCorosync: corosync: denial of service via integer overflow in join message validationEPSS 1.0%CVE-2025-31221HIGHAn integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS SequEPSS 1.0%CVE-2023-36593HIGHMicrosoft Message Queuing (MSMQ) Remote Code Execution VulnerabilityEPSS 1.0%CVE-2023-35372HIGHMicrosoft Office Visio Remote Code Execution VulnerabilityEPSS 1.0%CVE-2023-36582HIGHMicrosoft Message Queuing (MSMQ) Remote Code Execution VulnerabilityEPSS 1.0%CVE-2026-69586CRITICALMicrosoft Windows PDF Remote Code Execution VulnerabilityEPSS 1.0%CVE-2023-28097HIGHOpenSIPS has vulnerability in the Content-Length ParserEPSS 1.0%CVE-2025-55154HIGHImageMagick: integer overflows in MNG magnificationEPSS 1.0%CVE-2022-1926HIGHInteger Overflow or Wraparound in polonel/trudeskEPSS 1.0%CVE-2021-3477—There's a flaw in OpenEXR's deep tile sample size calculations in versions before 3.0.0-beta. An attacker who is able to submit a crafted fiEPSS 1.0%