Weaknesses of type CWE-190

1,661 results

Estouro ou envolvimento de inteiro

Ocorre quando uma operação aritmética produz um resultado maior (ou menor, em caso de sinal) do que o tipo de dado consegue representar, causando truncamento ou envolvimento para valores inesperados. Um atacante explora isso para contornar validações, causar alocações de memória inválidas ou alterar lógica de negócio.

Example

Um servidor calcula tamanho de buffer como `size = quantidade * 100`. Se quantidade for próxima ao máximo de um inteiro de 32 bits, a multiplicação estoura e retorna um valor pequeno, levando a alocação insuficiente e buffer overflow posterior.

How to mitigate

Valide limites antes de operações aritméticas (verifique se o resultado cabe no tipo), use tipos de dado maiores quando possível, ou aplique bibliotecas de aritmética segura que detectam estouro em tempo de execução.

CVE-2022-38216—An integer overflow exists in Mapbox's closed source gl-native library prior to version 10.6.1, which is bundled with multiple Mapbox producEPSS 0.8%CVE-2022-43608HIGHThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.03 EPSS 0.8%CVE-2022-21733MEDIUMMemory exhaustion in TensorflowEPSS 0.8%CVE-2023-34399CRITICALMercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Some values of this table are serialized archEPSS 0.8%CVE-2021-41345HIGHStorage Spaces Controller Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2025-14087MEDIUMGlib: glib: buffer underflow in gvariant parser leads to heap corruptionEPSS 0.8%CVE-2023-44709CRITICALPlutoSVG commit 336c02997277a1888e6ccbbbe674551a0582e5c4 and before was discovered to contain an integer overflow via the component plutosvgEPSS 0.8%CVE-2021-20303—A flaw found in function dataWindowForTile() of IlmImf/ImfTiledMisc.cpp. An attacker who is able to submit a crafted file to be processed byEPSS 0.8%CVE-2026-69499HIGHWindows Imaging Component Remote Code Execution VulnerabilityEPSS 0.8%CVE-2026-70351HIGHMicrosoft WebP Image Extension Remote Code Execution VulnerabilityEPSS 0.8%CVE-2026-69742HIGHMicrosoft Office Publisher Remote Code Execution VulnerabilityEPSS 0.8%CVE-2025-14242MEDIUMVsftpd: vsftpd: denial of service via integer overflow in ls command parameter parsingEPSS 0.8%CVE-2026-58594HIGHRemote Desktop Client Remote Code Execution VulnerabilityEPSS 0.8%CVE-2024-27833HIGHAn integer overflow was addressed with improved input validation. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5EPSS 0.8%CVE-2026-57974HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.8%CVE-2022-23558HIGHInteger overflow in TFLite array creationEPSS 0.8%CVE-2026-67376HIGHMicrosoft SQL Server Denial of Service VulnerabilityEPSS 0.8%CVE-2024-5197MEDIUMInteger overflow in libvpxEPSS 0.8%CVE-2023-41185HIGHUnified Automation UaGateway Certificate Parsing Integer Overflow Denial-of-Service VulnerabilityEPSS 0.8%CVE-2025-2174MEDIUMlibzvbi conv.c vbi_strndup_iconv_ucs2 integer overflowEPSS 0.8%