Weaknesses of type CWE-190

1,670 results

Estouro ou envolvimento de inteiro

Ocorre quando uma operação aritmética produz um resultado maior (ou menor, em caso de sinal) do que o tipo de dado consegue representar, causando truncamento ou envolvimento para valores inesperados. Um atacante explora isso para contornar validações, causar alocações de memória inválidas ou alterar lógica de negócio.

Example

Um servidor calcula tamanho de buffer como `size = quantidade * 100`. Se quantidade for próxima ao máximo de um inteiro de 32 bits, a multiplicação estoura e retorna um valor pequeno, levando a alocação insuficiente e buffer overflow posterior.

How to mitigate

Valide limites antes de operações aritméticas (verifique se o resultado cabe no tipo), use tipos de dado maiores quando possível, ou aplique bibliotecas de aritmética segura que detectam estouro em tempo de execução.

CVE-2026-50299MEDIUMWindows Storage Spaces Direct Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-62699MEDIUMWindows Universal Disk Format File System Driver (UDFS) Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-49168MEDIUMStorage Spaces Direct Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2025-62600HIGHeprosima Fast DDS affected by Out-of-Memory in readBinaryPropertySeq via Manipulated DATA Submessage when DDS Security is enabledEPSS 0.4%CVE-2026-48502HIGHMessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflowsEPSS 0.4%CVE-2026-40531MEDIUMAn integer overflow or wraparound vulnerability in File Operation in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7EPSS 0.4%CVE-2023-40548HIGHShim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systemsEPSS 0.4%CVE-2023-38623HIGHMultiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt fiEPSS 0.4%CVE-2026-16369CRITICALInteger overflow in the JavaScript: WebAssembly componentEPSS 0.4%CVE-2023-38620HIGHMultiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt fiEPSS 0.4%CVE-2025-66280MEDIUMQTS, QuTS heroEPSS 0.4%CVE-2021-39254MEDIUMA crafted NTFS image can cause an integer overflow in memmove, leading to a heap-based buffer overflow in the function ntfs_attr_record_resiEPSS 0.4%CVE-2024-58263LOWThe cosmwasm-std crate before 2.0.2 for Rust allows integer overflows that cause incorrect contract calculations.EPSS 0.4%CVE-2026-16408CRITICALInteger overflow in the Audio/Video: Playback componentEPSS 0.4%CVE-2024-52983HIGHAnimate | Integer Overflow or Wraparound (CWE-190)EPSS 0.4%CVE-2023-38619HIGHMultiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt fiEPSS 0.4%CVE-2023-21561HIGHMicrosoft Cryptographic Services Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2024-11347HIGHAccess of Resource Using Incompatible Type in Postscript interpreterEPSS 0.4%CVE-2023-38618HIGHMultiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt fiEPSS 0.4%CVE-2026-33642CRITICALKitty has a Heap Buffer Over-Read/Write via Integer Overflow in compose_rectangles Bounds CheckEPSS 0.4%