Weaknesses of type CWE-190

1,661 results

Estouro ou envolvimento de inteiro

Ocorre quando uma operação aritmética produz um resultado maior (ou menor, em caso de sinal) do que o tipo de dado consegue representar, causando truncamento ou envolvimento para valores inesperados. Um atacante explora isso para contornar validações, causar alocações de memória inválidas ou alterar lógica de negócio.

Example

Um servidor calcula tamanho de buffer como `size = quantidade * 100`. Se quantidade for próxima ao máximo de um inteiro de 32 bits, a multiplicação estoura e retorna um valor pequeno, levando a alocação insuficiente e buffer overflow posterior.

How to mitigate

Valide limites antes de operações aritméticas (verifique se o resultado cabe no tipo), use tipos de dado maiores quando possível, ou aplique bibliotecas de aritmética segura que detectam estouro em tempo de execução.

CVE-2024-46669LOWAn Integer Overflow or Wraparound vulnerability [CWE-190] in version 7.4.4 and below, version 7.2.10 and below; FortiSASE version 23.4.b ForEPSS 0.6%CVE-2021-27417MEDIUMeCosCentric eCosPro RTOS Integer Overflow or WraparoundEPSS 0.6%CVE-2026-20639HIGHAn integer overflow was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS TaEPSS 0.6%CVE-2025-30404CRITICALAn integer overflow vulnerability in the loading of ExecuTorch models can cause overlapping allocations, potentially resulting in code execuEPSS 0.6%CVE-2026-16917CRITICALVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.6%CVE-2025-30405CRITICALAn integer overflow vulnerability in the loading of ExecuTorch models can cause objects to be placed outside their allocated memory area, poEPSS 0.6%CVE-2026-4154HIGHGIMP XPM File Parsing Integer Overflow Remote Code Execution VulnerabilityEPSS 0.6%CVE-2021-20203—An integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5.2.0. It may occur if a guest was to supplyEPSS 0.6%CVE-2026-11378HIGHIBM MQ queue manager is vulnerable to remote code executionEPSS 0.6%CVE-2024-23307MEDIUMInteger overflow in raid5_cache_count in Linux kernelEPSS 0.6%CVE-2023-28237HIGHWindows Kernel Remote Code Execution VulnerabilityEPSS 0.6%CVE-2022-41550MEDIUMGNU oSIP v5.3.0 was discovered to contain an integer overflow via the component osip_body_parse_header.EPSS 0.6%CVE-2024-36616MEDIUMAn integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the appliEPSS 0.6%CVE-2026-46331HIGHnet/sched: fix pedit partial COW leading to page cache corruptionEPSS 0.6%CVE-2022-23562HIGHInteger overflow in TensorflowEPSS 0.6%CVE-2024-37976MEDIUMWindows Resume Extensible Firmware Interface Security Feature Bypass VulnerabilityEPSS 0.6%CVE-2026-8949HIGHInteger overflow in the Widget: Win32 componentEPSS 0.6%CVE-2025-69204MEDIUMImageMagick converting a malicious MVG file to SVG caused an integer overflow.EPSS 0.6%CVE-2026-27889HIGHNATS: Pre-auth remote server crash via WebSocket frame length overflow in wsReadEPSS 0.6%CVE-2026-39042HIGHAn issue in MikroTIk (SIA Mikrotikls, Latvia) RouterOS 7.21.x before v.7.21.4 and 7.22.x before v.7.22.2 allows a remote attacker to cause aEPSS 0.6%