Falhas do tipo CWE-190

1.920 resultados

Estouro ou Envolvimento de Inteiro

Ocorre quando uma operação aritmética produz um valor que excede o limite máximo (ou mínimo) que o tipo de dado inteiro pode armazenar, causando o valor envolver-se para o lado oposto ou comportamento inesperado. Isso permite que atacantes contornem validações, aloquem memória inadequada, ou causem travamentos ao explorar essa descontinuidade.

Exemplo

Um servidor de upload limita arquivos a 2 GB verificando se size < 2147483648 (INT_MAX). Um atacante envia size=2147483648, que em inteiro de 32 bits assinado vira -2147483648. A validação passa, mas durante a alocação de buffer o sistema trata como valor negativo ou inesperado, causando falha ou bypass de proteção.

Como mitigar

Use tipos inteiros sem sinal (unsigned) ou de maior capacidade (64 bits) quando apropriado; valide entradas contra limites explícitos *antes* de operações aritméticas; utilize funções de verificação de overflow fornecidas pela linguagem ou biblioteca (ex: __builtin_add_overflow em C, SafeInt em .NET); evite conversões implícitas entre tipos.

CVE-2026-43629CRITICALllama.cpp b4882–b9058 Buffer Overflow in KV Cache State RestoreEPSS 0.7%CVE-2026-6664HIGHPgBouncer integer overflow in PgBouncer network packet parsingEPSS 0.7%CVE-2026-63559HIGHo6 Automation open62541 Integer Overflow or WraparoundEPSS 0.7%CVE-2023-48236LOWoverflow in get_number in vimEPSS 0.7%CVE-2026-4689CRITICALSandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM componentEPSS 0.7%CVE-2026-86289MEDIUMOllama GGUF Decoder gguf.go readGGUFV1String integer overflowEPSS 0.7%CVE-2025-68794CRITICALiomap: adjust read range correctly for non-block-aligned positionsEPSS 0.7%CVE-2026-74964CRITICALInteger overflow in the Graphics componentEPSS 0.7%CVE-2022-41325HIGHAn integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4 allows attackers, by tricking a user into opening a crafEPSS 0.7%CVE-2026-11774HIGH389-ds-base: 389-ds-base: integer overflow in sasl packet length bypasses size limit leading to heap buffer overflowEPSS 0.7%CVE-2024-38215HIGHWindows Cloud Files Mini Filter Driver Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2023-35315HIGHWindows Layer-2 Bridge Network Driver Remote Code Execution VulnerabilityEPSS 0.7%CVE-2024-36619MEDIUMFFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certainEPSS 0.7%CVE-2026-43769CRITICALAn integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOSEPSS 0.7%CVE-2025-52581CRITICALAn integer overflow vulnerability exists in the GDF parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa)EPSS 0.7%CVE-2026-104016HIGHjackson-dataformat-protobuf: signed integer overflow in string-length paths allows unbounded array allocation and OutOfMemoryErrorEPSS 0.7%CVE-2023-38127HIGHAn integer overflow exists in the "HyperLinkFrame" stream parser of Ichitaro 2023 1.0.1.59372. A specially crafted document can cause the paEPSS 0.7%CVE-2026-23876HIGHHeap buffer overflow with attacker-controlled data in XBM parserEPSS 0.7%CVE-2025-40907MEDIUMFCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) libraryEPSS 0.7%CVE-2026-46195CRITICALsmb: client: validate dacloffset before building DACL pointersEPSS 0.7%