Weaknesses of type CWE-190

1,661 results

Estouro ou envolvimento de inteiro

Ocorre quando uma operação aritmética produz um resultado maior (ou menor, em caso de sinal) do que o tipo de dado consegue representar, causando truncamento ou envolvimento para valores inesperados. Um atacante explora isso para contornar validações, causar alocações de memória inválidas ou alterar lógica de negócio.

Example

Um servidor calcula tamanho de buffer como `size = quantidade * 100`. Se quantidade for próxima ao máximo de um inteiro de 32 bits, a multiplicação estoura e retorna um valor pequeno, levando a alocação insuficiente e buffer overflow posterior.

How to mitigate

Valide limites antes de operações aritméticas (verifique se o resultado cabe no tipo), use tipos de dado maiores quando possível, ou aplique bibliotecas de aritmética segura que detectam estouro em tempo de execução.

CVE-2026-69266HIGHWindows DHCP Server Remote Code Execution VulnerabilityEPSS 0.4%CVE-2025-41726HIGHBeckhoff: Arbitrary code execution within privileged processesEPSS 0.4%CVE-2026-84544HIGHAn integer overflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS TahEPSS 0.4%CVE-2026-34711HIGHCAI Content Credentials | Integer Overflow or Wraparound (CWE-190)EPSS 0.4%CVE-2026-54900MEDIUMOj: Negative-Size memcpy in Oj::Parser create_id Attribute HandlingEPSS 0.4%CVE-2026-25794HIGHImageMagick has heap-buffer-overflow via signed integer overflow in `WriteUHDRImage` when writing UHDR images with large dimensionsEPSS 0.4%CVE-2026-54903MEDIUMOj: Integer Overflow in Oj.load 2GB String HandlingEPSS 0.4%CVE-2026-41144NONEF´ (F Prime) has Integer Overflow in FileUplinkEPSS 0.4%CVE-2025-51495HIGHAn integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17. By sending a specially crafted WebSocket requEPSS 0.4%CVE-2026-40244HIGHOpenEXR has integer overflow in DWA setupChannelData planarUncRle pointer arithmetic (missed variant of CVE-2026-34589)EPSS 0.4%CVE-2026-33983MEDIUMFreeRDP: Progressive Codec Quant BYTE Underflow - UB + CPU DoSEPSS 0.4%CVE-2026-57235MEDIUMNokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`EPSS 0.4%CVE-2026-81959HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-81949HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-89146HIGHlibp2p-rendezvous through 0.17.1 Denial of Service via Unbounded Registration TTL in Discovery ResponsesEPSS 0.4%CVE-2026-14677HIGHPostgreSQL 32-bit pltcl and plperl undersize allocations, via integer wraparoundEPSS 0.4%CVE-2026-33611MEDIUMInsufficient validation of HTTPS and SVCB recordsEPSS 0.4%CVE-2025-5478HIGHSony XAV-AX8500 Bluetooth SDP Protocol Integer Overflow Remote Code Execution VulnerabilityEPSS 0.4%CVE-2024-39684MEDIUMTencent RapidJSON include/rapidjson/reader.h GenericReader::ParseNumber() Function Template Exponent Parsing Integer OverflowEPSS 0.4%CVE-2026-5477HIGHPrefix-substitution forgery via integer overflow in wolfCrypt CMACEPSS 0.4%