Falhas do tipo CWE-190

1.670 resultados

Estouro ou Envolvimento de Inteiro

Ocorre quando uma operação aritmética produz um valor que excede o limite máximo (ou mínimo) que o tipo de dado inteiro pode armazenar, causando o valor envolver-se para o lado oposto ou comportamento inesperado. Isso permite que atacantes contornem validações, aloquem memória inadequada, ou causem travamentos ao explorar essa descontinuidade.

Exemplo

Um servidor de upload limita arquivos a 2 GB verificando se size < 2147483648 (INT_MAX). Um atacante envia size=2147483648, que em inteiro de 32 bits assinado vira -2147483648. A validação passa, mas durante a alocação de buffer o sistema trata como valor negativo ou inesperado, causando falha ou bypass de proteção.

Como mitigar

Use tipos inteiros sem sinal (unsigned) ou de maior capacidade (64 bits) quando apropriado; valide entradas contra limites explícitos *antes* de operações aritméticas; utilize funções de verificação de overflow fornecidas pela linguagem ou biblioteca (ex: __builtin_add_overflow em C, SafeInt em .NET); evite conversões implícitas entre tipos.

CVE-2026-40449MEDIUMInteger overflow in buffer size calculation could result in out of bounds memory access when handling large tensors in Samsung Open Source OEPSS 0.1%CVE-2026-41667MEDIUMInteger overflow in constant tensor data size calculation in Samsung Open Source ONE could cause incorrect buffer sizing for large constant EPSS 0.1%CVE-2026-40450MEDIUMInteger overflow in output tensor copy size calculation in Samsung Open Source ONE could cause incorrect copy length and memory corruption fEPSS 0.1%CVE-2026-41666MEDIUMInteger overflow in tensor copy size calculation in Samsung Open Source ONE could lead to out of bounds access during loop state propagationEPSS 0.1%CVE-2026-30937MEDIUMImageMagick has a heap buffer overflow in WriteXWDImage due to CARD32 arithmetic overflow in bytes_per_line calculationEPSS 0.1%CVE-2024-28044LOWLiteos-A has an integer overflow vulnerabilityEPSS 0.1%CVE-2026-88035MEDIUMHeap buffer overflow via wrapped size check during SASL username canonicalization in MongoDB C DriverEPSS 0.1%CVE-2026-7162HIGHSuccessful exploitation of the integer overflow vulnerability could allow an attacker to achieve system-level access to the affected softwarEPSS 0.1%CVE-2026-41665MEDIUMInteger overflow in scratch buffer initialization size calculation in Samsung Open Source ONE cause incorrect memory initialization for largEPSS 0.1%CVE-2026-53059MEDIUMdm log: fix out-of-bounds write due to region_count overflowEPSS 0.1%CVE-2026-56404MEDIUMlibexpat before 2.8.2 has an integer overflow in addBinding.EPSS 0.1%CVE-2026-56405MEDIUMlibexpat before 2.8.2 has an integer overflow in getAttributeId.EPSS 0.1%CVE-2026-56403MEDIUMlibexpat before 2.8.2 has an integer overflow in storeAtts.EPSS 0.1%CVE-2026-56408MEDIUMlibexpat before 2.8.2 has an integer overflow in copyString.EPSS 0.1%CVE-2026-92259MEDIUMInteger overflow or wraparound vulnerability in Samsung Opensource Escargot allows attackers with write access to the bytecode-cache directoEPSS 0.1%CVE-2026-56406MEDIUMlibexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.EPSS 0.1%CVE-2026-56407MEDIUMlibexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.EPSS 0.1%CVE-2022-20454MEDIUMIn fdt_next_tag of fdt.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privileEPSS 0.1%CVE-2026-44636HIGHlibsixel: integer overflow in encoderEPSS 0.1%CVE-2026-56410MEDIUMxmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.EPSS 0.1%