Falhas do tipo CWE-190

1.657 resultados

Estouro ou Envolvimento de Inteiro

Ocorre quando uma operação aritmética produz um valor que excede o limite máximo (ou mínimo) que o tipo de dado inteiro pode armazenar, causando o valor envolver-se para o lado oposto ou comportamento inesperado. Isso permite que atacantes contornem validações, aloquem memória inadequada, ou causem travamentos ao explorar essa descontinuidade.

Exemplo

Um servidor de upload limita arquivos a 2 GB verificando se size < 2147483648 (INT_MAX). Um atacante envia size=2147483648, que em inteiro de 32 bits assinado vira -2147483648. A validação passa, mas durante a alocação de buffer o sistema trata como valor negativo ou inesperado, causando falha ou bypass de proteção.

Como mitigar

Use tipos inteiros sem sinal (unsigned) ou de maior capacidade (64 bits) quando apropriado; valide entradas contra limites explícitos *antes* de operações aritméticas; utilize funções de verificação de overflow fornecidas pela linguagem ou biblioteca (ex: __builtin_add_overflow em C, SafeInt em .NET); evite conversões implícitas entre tipos.

CVE-2018-11458—A vulnerability has been identified in SINUMERIK 828D V4.7 (All versions < V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions < V4.7 SP6 HFEPSS 4.6%CVE-2022-23852CRITICALExpat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.EPSS 4.6%CVE-2019-5052HIGHAn exploitable integer overflow vulnerability exists when loading a PCX file in SDL2_image 2.0.4. A specially crafted file can cause an inteEPSS 4.5%CVE-2022-24724HIGHInteger overflow in table parsing extension leads to heap memory corruptionEPSS 4.5%CVE-2024-20730HIGHTALOS-2023-1906 - Adobe Acrobat Reader Font CPAL integer overflow vulnerabilityEPSS 4.4%CVE-2018-13785MEDIUMIn libpng 1.6.34, a wrong calculation of row_factor in the png_check_chunk_length function (pngrutil.c) may trigger an integer overflow and EPSS 4.4%CVE-2023-5869HIGHPostgresql: buffer overrun from integer overflow in array modificationEPSS 4.3%CVE-2024-43623HIGHWindows NT OS Kernel Elevation of Privilege VulnerabilityEPSS 4.3%CVE-2021-29477HIGHVulnerability in the STRALGO LCS commandEPSS 4.2%CVE-2021-38185HIGHGNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overfEPSS 4.2%CVE-2021-32687HIGHInteger overflow issue with intsets in RedisEPSS 4.1%CVE-2025-54110HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 4.1%CVE-2017-10954—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security Internet SEPSS 4.0%CVE-2022-23990HIGHExpat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.EPSS 4.0%CVE-2019-5060HIGHAn exploitable code execution vulnerability exists in the XPM image rendering function of SDL2_image 2.0.4. A specially crafted XPM image caEPSS 4.0%CVE-2021-32627HIGHInteger overflow issue with Streams in RedisEPSS 3.9%CVE-2022-35951HIGHRedis subject to Integer Overflow leading to Remote Code Execution via Heap OverflowEPSS 3.9%CVE-2013-2806—Rockwell Automation RSLinx Enterprise Software (LogReceiver.exe) CPR9, CPR9-SR1, CPR9-SR2, CPR9-SR3, CPR9-SR4, CPR9-SR5, CPR9-SR5.1, and CPREPSS 3.9%CVE-2017-17409—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security 2018. UserEPSS 3.9%CVE-2013-2807—Rockwell Automation RSLinx Enterprise Software (LogReceiver.exe) CPR9, CPR9-SR1, CPR9-SR2, CPR9-SR3, CPR9-SR4, CPR9-SR5, CPR9-SR5.1, and CPREPSS 3.9%