Weaknesses of type CWE-190

1,661 results

Estouro ou envolvimento de inteiro

Ocorre quando uma operação aritmética produz um resultado maior (ou menor, em caso de sinal) do que o tipo de dado consegue representar, causando truncamento ou envolvimento para valores inesperados. Um atacante explora isso para contornar validações, causar alocações de memória inválidas ou alterar lógica de negócio.

Example

Um servidor calcula tamanho de buffer como `size = quantidade * 100`. Se quantidade for próxima ao máximo de um inteiro de 32 bits, a multiplicação estoura e retorna um valor pequeno, levando a alocação insuficiente e buffer overflow posterior.

How to mitigate

Valide limites antes de operações aritméticas (verifique se o resultado cabe no tipo), use tipos de dado maiores quando possível, ou aplique bibliotecas de aritmética segura que detectam estouro em tempo de execução.

CVE-2024-47537HIGHGHSL-2024-094: GStreamer has an OOB-write in isomp4/qtdemux.cEPSS 1.0%CVE-2023-34151—A vulnerability was found in ImageMagick. This security flaw ouccers as an undefined behaviors of casting double to size_t in svg, mvg and oEPSS 1.0%CVE-2022-1728HIGHAllowing long password leads to denial of service in polonel/trudesk in polonel/trudeskEPSS 1.0%CVE-2020-20335HIGHBuffer Overflow vulnerability in Antirez Kilo before commit 7709a04ae8520c5b04d261616098cebf742f5a23 allows a remote attacker to cause a denEPSS 1.0%CVE-2024-26184MEDIUMSecure Boot Security Feature Bypass VulnerabilityEPSS 1.0%CVE-2024-30001MEDIUMWindows Mobile Broadband Driver Remote Code Execution VulnerabilityEPSS 0.9%CVE-2024-43495HIGHWindows libarchive Remote Code Execution VulnerabilityEPSS 0.9%CVE-2021-4327MEDIUMSerenityOS TypedArray.cpp initialize_typed_array_from_array_buffer integer overflowEPSS 0.9%CVE-2019-11927—An integer overflow in WhatsApp media parsing libraries allows a remote attacker to perform an out-of-bounds write on the heap via speciallyEPSS 0.9%CVE-2024-29997MEDIUMWindows Mobile Broadband Driver Remote Code Execution VulnerabilityEPSS 0.9%CVE-2024-30003MEDIUMWindows Mobile Broadband Driver Remote Code Execution VulnerabilityEPSS 0.9%CVE-2024-30000MEDIUMWindows Mobile Broadband Driver Remote Code Execution VulnerabilityEPSS 0.9%CVE-2024-30005MEDIUMWindows Mobile Broadband Driver Remote Code Execution VulnerabilityEPSS 0.9%CVE-2024-29999MEDIUMWindows Mobile Broadband Driver Remote Code Execution VulnerabilityEPSS 0.9%CVE-2022-1475—An integer overflow vulnerability was found in FFmpeg versions before 4.4.2 and before 5.0.1 in g729_parse() in llibavcodec/g729_parser.c whEPSS 0.9%CVE-2026-41605HIGHApache Thrift: Swift Compact Protocol integer overflowEPSS 0.9%CVE-2026-14544CRITICALHplip: incomplete fix for cve-2026-8631EPSS 0.9%CVE-2021-42019MEDIUMA vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC,EPSS 0.9%CVE-2022-28705HIGHOn F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prEPSS 0.9%CVE-2023-32058HIGHVyper vulnerable to integer overflow in loopEPSS 0.9%