Falhas do tipo CWE-190

1.661 resultados

Estouro ou Envolvimento de Inteiro

Ocorre quando uma operação aritmética produz um valor que excede o limite máximo (ou mínimo) que o tipo de dado inteiro pode armazenar, causando o valor envolver-se para o lado oposto ou comportamento inesperado. Isso permite que atacantes contornem validações, aloquem memória inadequada, ou causem travamentos ao explorar essa descontinuidade.

Exemplo

Um servidor de upload limita arquivos a 2 GB verificando se size < 2147483648 (INT_MAX). Um atacante envia size=2147483648, que em inteiro de 32 bits assinado vira -2147483648. A validação passa, mas durante a alocação de buffer o sistema trata como valor negativo ou inesperado, causando falha ou bypass de proteção.

Como mitigar

Use tipos inteiros sem sinal (unsigned) ou de maior capacidade (64 bits) quando apropriado; valide entradas contra limites explícitos *antes* de operações aritméticas; utilize funções de verificação de overflow fornecidas pela linguagem ou biblioteca (ex: __builtin_add_overflow em C, SafeInt em .NET); evite conversões implícitas entre tipos.

CVE-2026-4985MEDIUMdloebl CGIF GIF Image cgif.c cgif_addframe integer overflowEPSS 0.5%CVE-2026-51536CRITICALIn OpENer 2.3.0 (commit 76b95cf) when parsing incoming CIP (Common Industrial Protocol) network packets, the length parameter is inconsistenEPSS 0.5%CVE-2026-75538HIGHA Signed Length Overflow in Erlang/OTP's inet TCP Driver Overflows the Receive Buffer Into BEAM VM Memory From an Unauthenticated PeerEPSS 0.5%CVE-2022-20532CRITICALIn parseTrackFragmentRun() of MPEG4Extractor.cpp, there is a possible out of bounds read due to an integer overflow. This could lead to remoEPSS 0.5%CVE-2026-17682CRITICALInteger overflow in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to poteEPSS 0.5%CVE-2026-17717CRITICALInteger overflow in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crEPSS 0.5%CVE-2026-62357HIGHDragonflyDB `CMS.INITBYDIM` integer overflow leads to a remote, attacker-controlled heap out-of-bounds writeEPSS 0.5%CVE-2026-73564HIGHfrp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer OverflowEPSS 0.5%CVE-2026-85438CRITICALMOOS-IvP through 24.8.1 Out-of-Bounds Write via Unvalidated IvP Payload CountsEPSS 0.5%CVE-2024-28923MEDIUMSecure Boot Security Feature Bypass VulnerabilityEPSS 0.5%CVE-2026-34588HIGHOpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/WriteEPSS 0.5%CVE-2024-46613MEDIUMWeeChat before 4.4.2 has an integer overflow and resultant buffer overflow at core/core-string.c when there are more than two billion items EPSS 0.5%CVE-2024-42384HIGHInteger Overflow or Wraparound in Mongoose Web Server libraryEPSS 0.5%CVE-2026-53482HIGHDell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1EPSS 0.5%CVE-2025-25248MEDIUMAn Integer Overflow or Wraparound vulnerability [CWE-190] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and beEPSS 0.5%CVE-2025-62496HIGHInteger overflow in js_bigint_from_string in QuickJSEPSS 0.5%CVE-2025-21338HIGHGDI+ Remote Code Execution VulnerabilityEPSS 0.5%CVE-2025-47712MEDIUMNbd: nbdkit: integer overflow triggers an assertion resulting in denial of serviceEPSS 0.5%CVE-2026-17673CRITICALInteger overflow in QUIC in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potenEPSS 0.5%CVE-2020-14310MEDIUMThere is an issue on grub2 before version 2.06 at function read_section_as_string(). It expects a font name to be at max UINT32_MAX - 1 lengEPSS 0.5%