Fallos del tipo CWE-191

491 resultados

Subfluxo de inteiro (estouro negativo)

Ocorre quando uma operação aritmética subtrai um valor maior de um inteiro não assinado, causando wraparound: o resultado "volta" para um número muito grande em vez de ficar negativo. Um inteiro de 8 bits sem sinal (0-255), ao subtrair 1 de 0, vira 255. Isso quebra lógica de validação e pode ser explorado para contornar limites de segurança, alocar memória inadequada ou acessar áreas indevidas.

Ejemplo

Um sistema de download que valida se o tamanho solicitado cabe em buffer: se recebe tamanho=0 e subtrai um header de 10 bytes, a conta (0 - 10) em inteiro não assinado resulta em 4.294.967.286 bytes em uma arquitetura de 32 bits, enganando a validação e causando overflow no buffer.

Cómo mitigar

Sempre validar entrada antes de operações aritméticas; usar tipos assinados quando desejar representar negativos; implementar verificações de limites (p.ex., se A < B antes de calcular A - B); usar ferramentas estáticas ou sanitizers (AddressSanitizer, UBSan) para detectar wraparound em tempo de desenvolvimento.

CVE-2023-48298MEDIUMInteger underflow leading to stack overflow in FPC codec decompressionEPSS 0.6%CVE-2026-116569HIGHFreeSWITCH: Pre-authentication out-of-bounds write in MSRP message body parsingEPSS 0.6%CVE-2020-14346—A flaw was found in xorg-x11-server before 1.20.9. An integer underflow in the X input extension protocol decoding in the X server may lead EPSS 0.6%CVE-2023-33158HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.6%CVE-2024-20474MEDIUMA vulnerability in Internet Key Exchange version 2 (IKEv2) processing of Cisco Secure Client Software could allow an unauthenticated, remoteEPSS 0.6%CVE-2020-14361—A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Integer underflow leading to heap-buffer overflow may lead to a privilegeEPSS 0.6%CVE-2026-53922MEDIUModhcpd: pre-auth remote DoS via size_t underflow in dhcpv6_ia_handle_IAs (stack BOF, canary-terminated)EPSS 0.6%CVE-2024-52558MEDIUMPlanet Technology Planet WGS-804HPT Integer UnderflowEPSS 0.6%CVE-2026-40356MEDIUMIn MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accepEPSS 0.6%CVE-2023-29349HIGHMicrosoft ODBC and OLE DB Remote Code Execution VulnerabilityEPSS 0.6%CVE-2026-91948HIGHFreeRDP before 3.31.0 Out-of-bounds Write via SHOW_PROTOCOLEPSS 0.6%CVE-2020-14362—A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Integer underflow leading to heap-buffer overflow may lead to a privilegeEPSS 0.6%CVE-2026-66033HIGHlibssh2 Integer Underflow DoS via AES-GCM Cipher NegotiationEPSS 0.6%CVE-2026-89028HIGHMikroTik RouterOS < 7.24 Heap Corruption via SMB1 SessionSetupAndXEPSS 0.6%CVE-2026-74755HIGHApache bRPC: Integer Underflow in mcpack2pb Parser Leading to Denial of ServiceEPSS 0.6%CVE-2026-51540CRITICALOpENer 2.3.0 (master branch up to commit 76b95cf) is vulnerable to a severe memory corruption issue caused by an integer underflow in the prEPSS 0.6%CVE-2025-67269HIGHAn integer underflow vulnerability exists in the `nextstate()` function in `gpsd/packet.c` of gpsd versions prior to commit `ffa1d6f40bca0b0EPSS 0.6%CVE-2026-58016HIGHGlib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"EPSS 0.6%CVE-2026-42542HIGHTDengine has an integer underflow in uvConnMayGetUserInfo() allows unauthenticated remote crash (DoS)EPSS 0.6%CVE-2026-112625HIGHAn integer underflow was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS EPSS 0.6%