Falhas do tipo CWE-190

1.657 resultados

Estouro ou Envolvimento de Inteiro

Ocorre quando uma operação aritmética produz um valor que excede o limite máximo (ou mínimo) que o tipo de dado inteiro pode armazenar, causando o valor envolver-se para o lado oposto ou comportamento inesperado. Isso permite que atacantes contornem validações, aloquem memória inadequada, ou causem travamentos ao explorar essa descontinuidade.

Exemplo

Um servidor de upload limita arquivos a 2 GB verificando se size < 2147483648 (INT_MAX). Um atacante envia size=2147483648, que em inteiro de 32 bits assinado vira -2147483648. A validação passa, mas durante a alocação de buffer o sistema trata como valor negativo ou inesperado, causando falha ou bypass de proteção.

Como mitigar

Use tipos inteiros sem sinal (unsigned) ou de maior capacidade (64 bits) quando apropriado; valide entradas contra limites explícitos *antes* de operações aritméticas; utilize funções de verificação de overflow fornecidas pela linguagem ou biblioteca (ex: __builtin_add_overflow em C, SafeInt em .NET); evite conversões implícitas entre tipos.

CVE-2022-22976—Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerabilEPSS 2.3%CVE-2022-31630MEDIUMOOB read due to insufficient input validation in imageloadfont()EPSS 2.3%CVE-2024-32039CRITICALFreeRDP Integer overflow & OutOfBound Write in clear_decompress_residual_dataEPSS 2.3%CVE-2018-16881MEDIUMA denial of service vulnerability was found in rsyslog in the imptcp module. An attacker could send a specially crafted message to the imptcEPSS 2.2%CVE-2022-24310—A CWE-190: Integer Overflow or Wraparound vulnerability exists that could cause heap-based buffer overflow, leading to denial of service andEPSS 2.2%CVE-2021-3402—An integer overflow and several buffer overflow reads in libyara/modules/macho/macho.c in YARA v4.0.3 and earlier could allow an attacker toEPSS 2.2%CVE-2025-21369HIGHMicrosoft Digest Authentication Remote Code Execution VulnerabilityEPSS 2.2%CVE-2020-27813—An integer overflow vulnerability exists with the length of websocket frames received via a websocket connection. An attacker would use thisEPSS 2.1%CVE-2022-2329CRITICALA CWE-190: Integer Overflow or Wraparound vulnerability exists that could cause heap-based buffer overflow, leading to denial of service andEPSS 2.1%CVE-2021-32765HIGHInteger Overflow to Buffer Overflow in HiredisEPSS 2.1%CVE-2021-3420—A flaw was found in newlib in versions prior to 4.0.0. Improper overflow validation in the memory allocation functions mEMALIGn, pvALLOc, naEPSS 2.1%CVE-2022-31005HIGHInteger Overflow in Vapor's HTTP Range RequestEPSS 2.1%CVE-2024-49089HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 2.1%CVE-2025-52520HIGHApache Tomcat: DoS via integer overflow in multipart file uploadEPSS 2.1%CVE-2019-5100HIGHAn exploitable integer overflow vulnerability exists in the BMP header parsing functionality of LEADTOOLS 20. A specially crafted BMP image EPSS 2.0%CVE-2023-21557HIGHWindows Lightweight Directory Access Protocol (LDAP) Denial of Service VulnerabilityEPSS 2.0%CVE-2024-21450HIGHMicrosoft WDAC OLE DB provider for SQL Server Remote Code Execution VulnerabilityEPSS 2.0%CVE-2016-9580LOWAn integer overflow vulnerability was found in tiftoimage function in openjpeg 2.1.2, resulting in heap buffer overflow.EPSS 2.0%CVE-2022-26775CRITICALAn integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2022-004 Catalina, macOS Monterey 1EPSS 2.0%CVE-2016-2120HIGHAn issue has been found in PowerDNS Authoritative Server versions up to and including 3.4.10, 4.0.1 allowing an authorized user to crash theEPSS 2.0%