Falhas do tipo CWE-190

1.956 resultados

Estouro ou Envolvimento de Inteiro

Ocorre quando uma operação aritmética produz um valor que excede o limite máximo (ou mínimo) que o tipo de dado inteiro pode armazenar, causando o valor envolver-se para o lado oposto ou comportamento inesperado. Isso permite que atacantes contornem validações, aloquem memória inadequada, ou causem travamentos ao explorar essa descontinuidade.

Exemplo

Um servidor de upload limita arquivos a 2 GB verificando se size < 2147483648 (INT_MAX). Um atacante envia size=2147483648, que em inteiro de 32 bits assinado vira -2147483648. A validação passa, mas durante a alocação de buffer o sistema trata como valor negativo ou inesperado, causando falha ou bypass de proteção.

Como mitigar

Use tipos inteiros sem sinal (unsigned) ou de maior capacidade (64 bits) quando apropriado; valide entradas contra limites explícitos *antes* de operações aritméticas; utilize funções de verificação de overflow fornecidas pela linguagem ou biblioteca (ex: __builtin_add_overflow em C, SafeInt em .NET); evite conversões implícitas entre tipos.

CVE-2026-116014CRITICALopen62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataTypeEPSS 0.4%CVE-2023-33976HIGHTensorFlow segfault in array_ops.upper_boundEPSS 0.4%CVE-2023-38621HIGHMultiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt fiEPSS 0.4%CVE-2023-36915HIGHMultiple integer overflow vulnerabilities exist in the FST fstReaderIterBlocks2 chain_table allocation functionality of GTKWave 3.3.115. A sEPSS 0.4%CVE-2023-38622HIGHMultiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt fiEPSS 0.4%CVE-2023-35004HIGHAn integer overflow vulnerability exists in the VZT longest_len value allocation functionality of GTKWave 3.3.115. A specially crafted .vzt EPSS 0.4%CVE-2023-35989HIGHAn integer overflow vulnerability exists in the LXT2 zlib block allocation functionality of GTKWave 3.3.115. A specially crafted .lxt2 file EPSS 0.4%CVE-2026-34711HIGHCAI Content Credentials | Integer Overflow or Wraparound (CWE-190)EPSS 0.4%CVE-2026-93546HIGHApache HTTP Server: mod_dav_fs namespace overflowEPSS 0.4%CVE-2026-9621CRITICALRSLinx Classic® - Multiple VulnerabilitiesEPSS 0.4%CVE-2026-41144NONEF´ (F Prime) has Integer Overflow in FileUplinkEPSS 0.4%CVE-2026-18142HIGHIBM MQ is affected by a denial of service vulnerabilityEPSS 0.4%CVE-2026-40244HIGHOpenEXR has integer overflow in DWA setupChannelData planarUncRle pointer arithmetic (missed variant of CVE-2026-34589)EPSS 0.4%CVE-2026-113250HIGHInteger overflow in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside thEPSS 0.4%CVE-2025-68431MEDIUMlibheif has Potential Heap Buffer Over-ReadEPSS 0.4%CVE-2026-34589HIGHOpenEXR: DWA Lossy Decoder Heap Out-of-Bounds WriteEPSS 0.4%CVE-2026-57235MEDIUMNokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`EPSS 0.4%CVE-2026-85908HIGHWindows Graphics Component Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2025-51495HIGHAn integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17. By sending a specially crafted WebSocket requEPSS 0.4%CVE-2026-33611MEDIUMInsufficient validation of HTTPS and SVCB recordsEPSS 0.4%