Falhas do tipo CWE-190

1.956 resultados

Estouro ou Envolvimento de Inteiro

Ocorre quando uma operação aritmética produz um valor que excede o limite máximo (ou mínimo) que o tipo de dado inteiro pode armazenar, causando o valor envolver-se para o lado oposto ou comportamento inesperado. Isso permite que atacantes contornem validações, aloquem memória inadequada, ou causem travamentos ao explorar essa descontinuidade.

Exemplo

Um servidor de upload limita arquivos a 2 GB verificando se size < 2147483648 (INT_MAX). Um atacante envia size=2147483648, que em inteiro de 32 bits assinado vira -2147483648. A validação passa, mas durante a alocação de buffer o sistema trata como valor negativo ou inesperado, causando falha ou bypass de proteção.

Como mitigar

Use tipos inteiros sem sinal (unsigned) ou de maior capacidade (64 bits) quando apropriado; valide entradas contra limites explícitos *antes* de operações aritméticas; utilize funções de verificação de overflow fornecidas pela linguagem ou biblioteca (ex: __builtin_add_overflow em C, SafeInt em .NET); evite conversões implícitas entre tipos.

CVE-2026-45686HIGHOpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBIEPSS 0.4%CVE-2026-87702HIGHWindows Resource Management (MRM) Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2020-10724MEDIUMA vulnerability was found in DPDK versions 18.11 and above. The vhost-crypto library code is missing validations for user-supplied values, pEPSS 0.4%CVE-2025-7458MEDIUMSQLite integer overflow in key info allocation may lead to information disclosure.EPSS 0.4%CVE-2023-25903HIGHAdobe Dimension USDZ files Integer Overflow or Wraparound Arbitrary code execution EPSS 0.4%CVE-2026-83828HIGHWindows MIDI Service Module Elevation of Privileges VulnerabilityEPSS 0.4%CVE-2026-96118HIGHWindows Graphics Kernel Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-119279MEDIUMMariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengthsEPSS 0.4%CVE-2026-102692CRITICALRIOT: Potential integer overflow in nanocoap Block2 handling leading to out-of-bounds memory accessEPSS 0.4%CVE-2026-58882HIGHIn decodeWapPdu of WapPushOverSms.java, there is a possible out of bounds read due to an integer overflow. This could lead to a remote deniaEPSS 0.4%CVE-2026-66837HIGHApache Thrift: PHP accelerator sizes a stack buffer from a wire-controlled string lengthEPSS 0.3%CVE-2026-69846HIGHWindows Secure Kernel Mode Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-89157MEDIUMPCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.EPSS 0.3%CVE-2026-69373MEDIUMWindows Overlay Filter Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-63925HIGHmacsec: fix replay protection at XPN lower-PN wrapEPSS 0.3%CVE-2026-102804MEDIUMNothings stb stb_hexwave.h hexwave_init integer overflowEPSS 0.3%CVE-2026-102805MEDIUMNothings stb Image Encoding stb_image_write.h stbi_write_tga_core integer overflowEPSS 0.3%CVE-2025-13601HIGHGlib: integer overflow in in g_escape_uri_string()EPSS 0.3%CVE-2025-67111HIGHAn integer overflow in the RTPS protocol implementation of OpenDDS DDS before v3.33.0 allows attackers to cause a Denial of Service (DoS) viEPSS 0.3%CVE-2026-24830CRITICALInteger Overflow or Wraparound in IronOSEPSS 0.3%