Weaknesses of type CWE-195

37 results

Erro de conversão de inteiro com sinal para sem sinal

Ocorre quando um valor inteiro com sinal (que pode ser negativo) é convertido ou comparado com um tipo sem sinal, causando comportamento inesperado. Um número negativo, quando interpretado como sem sinal, vira um valor muito grande, podendo contornar validações ou causar alocações excessivas de memória.

Example

Um desenvolvedor valida se um `int` (com sinal) recebido do usuário é menor que 100 antes de alocar um buffer. Se o valor for -1, a comparação com 100 passa na validação, mas ao converter para `unsigned int` para usar em malloc(), -1 vira 4.294.967.295 bytes — causando falha ou overflow.

How to mitigate

Sempre validar o sinal antes de converter para tipo sem sinal; preferir manter cálculos em tipos com sinal quando possível; usar compiladores com avisos para conversões implícitas ativados (-Wsign-conversion no GCC/Clang); implementar validação explícita do intervalo de valores esperados.

CVE-2022-43663HIGHAn integer conversion vulnerability exists in the SORBAx64.dll RecvPacket functionality of WellinTech KingHistorian 35.01.00.05. A speciallyEPSS 14.0%CVE-2020-6096HIGHAn exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMvEPSS 5.5%CVE-2011-3045HIGHInteger signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.8EPSS 3.2%CVE-2016-6560—illumos osnet-incorporation bcopy() and bzero() implementations make signed instead of unsigned comparisons allowing a system crash.EPSS 1.7%CVE-2023-3635MEDIUMOkio GzipSource unhandled exception Denial of ServiceEPSS 1.3%CVE-2020-1913—An Integer signedness error in the JavaScript Interpreter in Facebook Hermes prior to commit 2c7af7ec481ceffd0d14ce2d7c045e475fd71dc6 allowsEPSS 1.2%CVE-2026-85441HIGHMOOS core-moos through 10.4.0 MOOSDB Denial of Service via Negative Serialized String LengthEPSS 0.7%CVE-2026-26981MEDIUMOpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cppEPSS 0.6%CVE-2026-62959HIGHCoturn: Pre-authentication heap memory disclosure in ACME redirect (`try_acme_redirect`)EPSS 0.5%CVE-2026-77406HIGHRabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos ConfigurationEPSS 0.5%CVE-2025-49847HIGHllama.cpp Vulnerable to Buffer Overflow via Malicious GGUF ModelEPSS 0.5%CVE-2026-20248MEDIUMCisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software TCP DNS Denial of Service VulnerabilityEPSS 0.5%CVE-2023-5184HIGHPotential signed to unsigned conversion errors and buffer overflow vulnerabilities in the Zephyr IPM driverEPSS 0.4%CVE-2026-17507HIGHMLS membership checks compare a uint32 leaf_index as signed, admitting an out-of-range senderEPSS 0.4%CVE-2026-115678MEDIUMArm Keil MDK-Middleware 8.0.0-8.3.0 may allow pre-authentication out-of-bounds read in SNMP processingEPSS 0.4%CVE-2026-55991MEDIUMRemote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2EPSS 0.4%CVE-2025-52566HIGHllama.cpp tokenizer signed vs. unsigned heap overflowEPSS 0.4%CVE-2025-67897MEDIUMIn Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue EPSS 0.4%CVE-2026-41682MEDIUMpupnp: Port truncation via atoi() cast in parse_uri() allows SSRF port confusionEPSS 0.3%CVE-2026-74221HIGHU-Boot before 2026.10-rc5 Buffer Overflow via NFS READLINKEPSS 0.3%