Weaknesses of type CWE-190

1,657 results

Estouro ou envolvimento de inteiro

Ocorre quando uma operação aritmética produz um resultado maior (ou menor, em caso de sinal) do que o tipo de dado consegue representar, causando truncamento ou envolvimento para valores inesperados. Um atacante explora isso para contornar validações, causar alocações de memória inválidas ou alterar lógica de negócio.

Example

Um servidor calcula tamanho de buffer como `size = quantidade * 100`. Se quantidade for próxima ao máximo de um inteiro de 32 bits, a multiplicação estoura e retorna um valor pequeno, levando a alocação insuficiente e buffer overflow posterior.

How to mitigate

Valide limites antes de operações aritméticas (verifique se o resultado cabe no tipo), use tipos de dado maiores quando possível, ou aplique bibliotecas de aritmética segura que detectam estouro em tempo de execução.

CVE-2025-24985HIGHWindows Fast FAT File System Driver Remote Code Execution VulnerabilityEPSS 3.8%KEVCVE-2025-46817HIGHLua library commands may lead to integer overflow and potential RCEEPSS 3.8%CVE-2021-46143HIGHIn doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.EPSS 3.8%CVE-2023-36478HIGHHTTP/2 HPACK integer overflow and buffer allocationEPSS 3.8%CVE-2022-0968HIGHThe microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber in microweber/microweberEPSS 3.7%CVE-2026-48933HIGHA flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerabiEPSS 3.7%CVE-2020-6094CRITICALAn exploitable code execution vulnerability exists in the TIFF fillinraster function of the igcore19d.dll library of Accusoft ImageGear 19.4EPSS 3.7%CVE-2021-41099HIGHInteger overflow issue with strings in RedisEPSS 3.6%CVE-2023-33864CRITICALStreamReader::ReadFromExternal in RenderDoc before 1.27 allows an Integer Overflow with a resultant Buffer Overflow. It uses uint32_t(m_BuffEPSS 3.6%CVE-2023-33863CRITICALSerialiseValue in RenderDoc before 1.27 allows an Integer Overflow with a resultant Buffer Overflow. 0xffffffff is sign-extended to 0xffffffEPSS 3.6%CVE-2021-29478HIGHVulnerability in the COPY command for large intsetsEPSS 3.6%CVE-2019-5059HIGHAn exploitable code execution vulnerability exists in the XPM image rendering functionality of SDL2_image 2.0.4. A specially crafted XPM imaEPSS 3.5%CVE-2021-30663HIGHAn integer overflow was addressed with improved input validation. This issue is fixed in iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3EPSS 3.5%KEVCVE-2022-24795MEDIUMBuffer Overflow and Integer Overflow in yajl-rubyEPSS 3.5%CVE-2019-3863HIGHA flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactivEPSS 3.4%CVE-2022-22823CRITICALbuild_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.EPSS 3.4%CVE-2022-22824CRITICALdefineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.EPSS 3.4%CVE-2019-5085CRITICALAn exploitable code execution vulnerability exists in the DICOM packet-parsing functionality of LEADTOOLS libltdic.so, version 20.0.2019.3.1EPSS 3.4%CVE-2017-20005CRITICALNGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modification date in 1969 thatEPSS 3.3%CVE-2023-24871HIGHWindows Bluetooth Service Remote Code Execution VulnerabilityEPSS 3.2%