Weaknesses of type CWE-190

1,661 results

Estouro ou envolvimento de inteiro

Ocorre quando uma operação aritmética produz um resultado maior (ou menor, em caso de sinal) do que o tipo de dado consegue representar, causando truncamento ou envolvimento para valores inesperados. Um atacante explora isso para contornar validações, causar alocações de memória inválidas ou alterar lógica de negócio.

Example

Um servidor calcula tamanho de buffer como `size = quantidade * 100`. Se quantidade for próxima ao máximo de um inteiro de 32 bits, a multiplicação estoura e retorna um valor pequeno, levando a alocação insuficiente e buffer overflow posterior.

How to mitigate

Valide limites antes de operações aritméticas (verifique se o resultado cabe no tipo), use tipos de dado maiores quando possível, ou aplique bibliotecas de aritmética segura que detectam estouro em tempo de execução.

CVE-2023-40548HIGHShim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systemsEPSS 0.4%CVE-2026-16369CRITICALInteger overflow in the JavaScript: WebAssembly componentEPSS 0.4%CVE-2026-15742HIGHPostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparoundEPSS 0.4%CVE-2026-16408CRITICALInteger overflow in the Audio/Video: Playback componentEPSS 0.4%CVE-2024-52983HIGHAnimate | Integer Overflow or Wraparound (CWE-190)EPSS 0.4%CVE-2026-50347HIGHWindows Data.dll Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-33900MEDIUMImageMagick has a Heap overflow caused by integer overflow/wraparound in viff encoder on 32-bit buildsEPSS 0.4%CVE-2023-38618HIGHMultiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt fiEPSS 0.4%CVE-2024-11347HIGHAccess of Resource Using Incompatible Type in Postscript interpreterEPSS 0.4%CVE-2026-63559HIGHo6 Automation open62541 Integer Overflow or WraparoundEPSS 0.4%CVE-2023-38619HIGHMultiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt fiEPSS 0.4%CVE-2023-21561HIGHMicrosoft Cryptographic Services Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-69266HIGHWindows DHCP Server Remote Code Execution VulnerabilityEPSS 0.4%CVE-2023-38621HIGHMultiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt fiEPSS 0.4%CVE-2023-35004HIGHAn integer overflow vulnerability exists in the VZT longest_len value allocation functionality of GTKWave 3.3.115. A specially crafted .vzt EPSS 0.4%CVE-2023-36916HIGHMultiple integer overflow vulnerabilities exist in the FST fstReaderIterBlocks2 chain_table allocation functionality of GTKWave 3.3.115. A sEPSS 0.4%CVE-2023-35989HIGHAn integer overflow vulnerability exists in the LXT2 zlib block allocation functionality of GTKWave 3.3.115. A specially crafted .lxt2 file EPSS 0.4%CVE-2026-87823HIGHzstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size MethodsEPSS 0.4%CVE-2023-33976HIGHTensorFlow segfault in array_ops.upper_boundEPSS 0.4%CVE-2023-38622HIGHMultiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt fiEPSS 0.4%