Weaknesses of type CWE-190

1,661 results

Estouro ou envolvimento de inteiro

Ocorre quando uma operação aritmética produz um resultado maior (ou menor, em caso de sinal) do que o tipo de dado consegue representar, causando truncamento ou envolvimento para valores inesperados. Um atacante explora isso para contornar validações, causar alocações de memória inválidas ou alterar lógica de negócio.

Example

Um servidor calcula tamanho de buffer como `size = quantidade * 100`. Se quantidade for próxima ao máximo de um inteiro de 32 bits, a multiplicação estoura e retorna um valor pequeno, levando a alocação insuficiente e buffer overflow posterior.

How to mitigate

Valide limites antes de operações aritméticas (verifique se o resultado cabe no tipo), use tipos de dado maiores quando possível, ou aplique bibliotecas de aritmética segura que detectam estouro em tempo de execução.

CVE-2020-8874HIGHThis vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-47123. An attacker muEPSS 0.4%CVE-2026-53432MEDIUMInteger Overflow in fzfEPSS 0.4%CVE-2026-34589HIGHOpenEXR: DWA Lossy Decoder Heap Out-of-Bounds WriteEPSS 0.4%CVE-2023-39274HIGHMultiple integer overflow vulnerabilities exist in the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .lxt2 EPSS 0.4%CVE-2024-58263LOWThe cosmwasm-std crate before 2.0.2 for Rust allows integer overflows that cause incorrect contract calculations.EPSS 0.4%CVE-2023-39275HIGHMultiple integer overflow vulnerabilities exist in the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .lxt2 EPSS 0.4%CVE-2023-36864HIGHAn integer overflow vulnerability exists in the fstReaderIterBlocks2 temp_signal_value_buf allocation functionality of GTKWave 3.3.115. A spEPSS 0.4%CVE-2026-54417HIGHInteger Overflow in rxi/microtar mtar_next() Causes Infinite Loop DoSEPSS 0.4%CVE-2026-26178HIGHWindows Advanced Rasterization Platform Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2023-39317HIGHMultiple integer overflow vulnerabilities exist in the LXT2 num_dict_entries functionality of GTKWave 3.3.115. A specially crafted .lxt2 filEPSS 0.4%CVE-2023-39273HIGHMultiple integer overflow vulnerabilities exist in the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .lxt2 EPSS 0.4%CVE-2023-39271HIGHMultiple integer overflow vulnerabilities exist in the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .lxt2 EPSS 0.4%CVE-2023-39316HIGHMultiple integer overflow vulnerabilities exist in the LXT2 num_dict_entries functionality of GTKWave 3.3.115. A specially crafted .lxt2 filEPSS 0.4%CVE-2023-39270HIGHMultiple integer overflow vulnerabilities exist in the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .lxt2 EPSS 0.4%CVE-2023-39272HIGHMultiple integer overflow vulnerabilities exist in the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .lxt2 EPSS 0.4%CVE-2024-10917LOWEclipse OpenJ9 might return an incorrect value in JNI function GetStringUTFLengthEPSS 0.4%CVE-2026-77408CRITICALRabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer OverflowEPSS 0.4%CVE-2026-17726CRITICALInteger overflow in WebGL in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escaEPSS 0.4%CVE-2026-19389HIGHGstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds readEPSS 0.4%CVE-2026-27809MEDIUMpsd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gapsEPSS 0.4%