Falhas do tipo CWE-190

1.956 resultados

Estouro ou Envolvimento de Inteiro

Ocorre quando uma operação aritmética produz um valor que excede o limite máximo (ou mínimo) que o tipo de dado inteiro pode armazenar, causando o valor envolver-se para o lado oposto ou comportamento inesperado. Isso permite que atacantes contornem validações, aloquem memória inadequada, ou causem travamentos ao explorar essa descontinuidade.

Exemplo

Um servidor de upload limita arquivos a 2 GB verificando se size < 2147483648 (INT_MAX). Um atacante envia size=2147483648, que em inteiro de 32 bits assinado vira -2147483648. A validação passa, mas durante a alocação de buffer o sistema trata como valor negativo ou inesperado, causando falha ou bypass de proteção.

Como mitigar

Use tipos inteiros sem sinal (unsigned) ou de maior capacidade (64 bits) quando apropriado; valide entradas contra limites explícitos *antes* de operações aritméticas; utilize funções de verificação de overflow fornecidas pela linguagem ou biblioteca (ex: __builtin_add_overflow em C, SafeInt em .NET); evite conversões implícitas entre tipos.

CVE-2026-103634MEDIUMApache DataSketches: datasketches-cpp: Out-of-bounds read and write in Count-Min sketch deserialization allows memory corruption via a crafted sketchEPSS 0.5%CVE-2024-42384HIGHInteger Overflow or Wraparound in Mongoose Web Server libraryEPSS 0.5%CVE-2024-9123HIGHInteger overflow in Skia in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform an out of bounds memory write via a crEPSS 0.5%CVE-2025-55753HIGHApache HTTP Server: mod_md (ACME), unintended retry intervalsEPSS 0.5%CVE-2024-28923MEDIUMSecure Boot Security Feature Bypass VulnerabilityEPSS 0.5%CVE-2025-21338HIGHGDI+ Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-69469MEDIUMWindows USB Audio Class driver (usbaudio.sys) Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2025-22059HIGHudp: Fix multiple wraparounds of sk->sk_rmem_alloc.EPSS 0.5%CVE-2025-41726HIGHBeckhoff: Arbitrary code execution within privileged processesEPSS 0.5%CVE-2026-53482HIGHDell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1EPSS 0.5%CVE-2026-16529HIGHPcp: pcp: denial of service due to signed integer overflowEPSS 0.5%CVE-2025-64098LOWFastDDS has Out-of-memory in readOctetVector via Manipulated DATA Submessage when DDS Security is enabledEPSS 0.5%CVE-2024-46613MEDIUMWeeChat before 4.4.2 has an integer overflow and resultant buffer overflow at core/core-string.c when there are more than two billion items EPSS 0.5%CVE-2026-27809MEDIUMpsd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gapsEPSS 0.5%CVE-2026-105959HIGHSpice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncationEPSS 0.5%CVE-2026-116787HIGHFreeSWITCH: Pre-authentication process termination in the Event Socket via an unbounded Content-LengthEPSS 0.5%CVE-2026-31970HIGHHTSlib BGZF index file reader has a heap buffer overflowEPSS 0.5%CVE-2023-21765HIGHWindows Print Spooler Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-73193CRITICALDBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparseEPSS 0.5%CVE-2025-3500CRITICALInteger Overflow in Avast Antiviurs 25.1.981.6 on Windows may result in privilege escalationEPSS 0.5%