Falhas do tipo CWE-190

1.956 resultados

Estouro ou Envolvimento de Inteiro

Ocorre quando uma operação aritmética produz um valor que excede o limite máximo (ou mínimo) que o tipo de dado inteiro pode armazenar, causando o valor envolver-se para o lado oposto ou comportamento inesperado. Isso permite que atacantes contornem validações, aloquem memória inadequada, ou causem travamentos ao explorar essa descontinuidade.

Exemplo

Um servidor de upload limita arquivos a 2 GB verificando se size < 2147483648 (INT_MAX). Um atacante envia size=2147483648, que em inteiro de 32 bits assinado vira -2147483648. A validação passa, mas durante a alocação de buffer o sistema trata como valor negativo ou inesperado, causando falha ou bypass de proteção.

Como mitigar

Use tipos inteiros sem sinal (unsigned) ou de maior capacidade (64 bits) quando apropriado; valide entradas contra limites explícitos *antes* de operações aritméticas; utilize funções de verificação de overflow fornecidas pela linguagem ou biblioteca (ex: __builtin_add_overflow em C, SafeInt em .NET); evite conversões implícitas entre tipos.

CVE-2022-25314HIGHIn Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.EPSS 4.8%CVE-2021-21309MEDIUMInteger overflow on 32-bit systemsEPSS 4.8%CVE-2025-54110HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 4.7%CVE-2022-23990HIGHExpat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.EPSS 4.7%CVE-2016-8622LOWThe URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if this function would beEPSS 4.7%CVE-2018-11458—A vulnerability has been identified in SINUMERIK 828D V4.7 (All versions < V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions < V4.7 SP6 HFEPSS 4.6%CVE-2019-5052HIGHAn exploitable integer overflow vulnerability exists when loading a PCX file in SDL2_image 2.0.4. A specially crafted file can cause an inteEPSS 4.5%CVE-2022-24724HIGHInteger overflow in table parsing extension leads to heap memory corruptionEPSS 4.5%CVE-2024-43623HIGHWindows NT OS Kernel Elevation of Privilege VulnerabilityEPSS 4.5%CVE-2021-46143HIGHIn doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.EPSS 4.5%CVE-2024-20730HIGHTALOS-2023-1906 - Adobe Acrobat Reader Font CPAL integer overflow vulnerabilityEPSS 4.4%CVE-2018-13785MEDIUMIn libpng 1.6.34, a wrong calculation of row_factor in the png_check_chunk_length function (pngrutil.c) may trigger an integer overflow and EPSS 4.4%CVE-2023-5869HIGHPostgresql: buffer overrun from integer overflow in array modificationEPSS 4.3%CVE-2023-33863CRITICALSerialiseValue in RenderDoc before 1.27 allows an Integer Overflow with a resultant Buffer Overflow. 0xffffffff is sign-extended to 0xffffffEPSS 4.2%CVE-2023-33864CRITICALStreamReader::ReadFromExternal in RenderDoc before 1.27 allows an Integer Overflow with a resultant Buffer Overflow. It uses uint32_t(m_BuffEPSS 4.2%CVE-2021-38185HIGHGNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overfEPSS 4.2%CVE-2021-32687HIGHInteger overflow issue with intsets in RedisEPSS 4.1%CVE-2017-10954—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security Internet SEPSS 4.0%CVE-2021-29477HIGHVulnerability in the STRALGO LCS commandEPSS 4.0%CVE-2019-5060HIGHAn exploitable code execution vulnerability exists in the XPM image rendering function of SDL2_image 2.0.4. A specially crafted XPM image caEPSS 4.0%