Falhas do tipo CWE-190

1.657 resultados

Estouro ou Envolvimento de Inteiro

Ocorre quando uma operação aritmética produz um valor que excede o limite máximo (ou mínimo) que o tipo de dado inteiro pode armazenar, causando o valor envolver-se para o lado oposto ou comportamento inesperado. Isso permite que atacantes contornem validações, aloquem memória inadequada, ou causem travamentos ao explorar essa descontinuidade.

Exemplo

Um servidor de upload limita arquivos a 2 GB verificando se size < 2147483648 (INT_MAX). Um atacante envia size=2147483648, que em inteiro de 32 bits assinado vira -2147483648. A validação passa, mas durante a alocação de buffer o sistema trata como valor negativo ou inesperado, causando falha ou bypass de proteção.

Como mitigar

Use tipos inteiros sem sinal (unsigned) ou de maior capacidade (64 bits) quando apropriado; valide entradas contra limites explícitos *antes* de operações aritméticas; utilize funções de verificação de overflow fornecidas pela linguagem ou biblioteca (ex: __builtin_add_overflow em C, SafeInt em .NET); evite conversões implícitas entre tipos.

CVE-2026-28952HIGHAn integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7,EPSS 0.6%CVE-2024-41184CRITICALIn the vrrp_ipsets_handler handler (fglobal_parser.c) of keepalived through 2.3.1, an integer overflow can occur. NOTE: this CVE Record mighEPSS 0.6%CVE-2026-67384HIGHMicrosoft SQL Server Remote Code Execution VulnerabilityEPSS 0.6%CVE-2026-67641MEDIUMMicrosoft SQL Server Denial of Service VulnerabilityEPSS 0.6%CVE-2026-34545HIGHOpenEXR: integer overflow lead to OOB in HTJ2K decoderEPSS 0.6%CVE-2025-40906CRITICALBSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilitiesEPSS 0.6%CVE-2026-59117HIGHWindows Terminal Remote Code Execution VulnerabilityEPSS 0.6%CVE-2024-22861HIGHInteger overflow vulnerability in FFmpeg before n6.1, allows attackers to cause a denial of service (DoS) via the avcodec/osq module.EPSS 0.6%CVE-2025-2175MEDIUMlibzvbi _vbi_strndup_iconv integer overflowEPSS 0.6%CVE-2025-30712HIGHVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.EPSS 0.6%CVE-2026-65423HIGHo6 Automation open62541 Integer Overflow or WraparoundEPSS 0.6%CVE-2023-0933HIGHInteger overflow in PDF in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafEPSS 0.6%CVE-2026-8956CRITICALInteger overflow in the Networking: JAR componentEPSS 0.6%CVE-2026-24210HIGHNVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an integer overflow. A successful exploit of this vulnEPSS 0.6%CVE-2026-43764CRITICALAn integer overflow was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS TaEPSS 0.6%CVE-2026-64694CRITICALAn integer overflow was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS TaEPSS 0.6%CVE-2024-21631MEDIUMInteger overflow in URI leading to potential host spoofingEPSS 0.6%CVE-2019-11476MEDIUMInteger overflow in whoopsie results in out-of-bounds heap writeEPSS 0.6%CVE-2021-27417MEDIUMeCosCentric eCosPro RTOS Integer Overflow or WraparoundEPSS 0.6%CVE-2024-46669LOWAn Integer Overflow or Wraparound vulnerability [CWE-190] in version 7.4.4 and below, version 7.2.10 and below; FortiSASE version 23.4.b ForEPSS 0.6%