Falhas do tipo CWE-195

22 resultados

Erro de conversão de inteiro com sinal para sem sinal

Ocorre quando um valor inteiro com sinal (que pode ser negativo) é convertido para sem sinal sem validação prévia. Um número negativo, ao ser reinterpretado como sem sinal, vira um número muito grande, causando lógica quebrada em comparações, alocações de memória ou loops.

Exemplo

Uma função recebe um inteiro com sinal do usuário, usa-o em uma comparação de tamanho (ex: if (tamanho < 1000) alocaMem(tamanho)) e depois o converte para sem sinal. Um valor negativo passa na comparação, vira um número gigante ao ser convertido, e a alocação fica fora de controle.

Como mitigar

Valide explicitamente que valores com sinal são não-negativos antes de qualquer conversão para sem sinal. Use verificações de range claras e evite conversões implícitas; em C/C++, compile com avisos de conversão ativados (-Wconversion).

CVE-2022-43663HIGHAn integer conversion vulnerability exists in the SORBAx64.dll RecvPacket functionality of WellinTech KingHistorian 35.01.00.05. A speciallyEPSS 14.0%CVE-2020-6096HIGHAn exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMvEPSS 5.2%CVE-2011-3045HIGHInteger signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.8EPSS 3.6%CVE-2016-6560—illumos osnet-incorporation bcopy() and bzero() implementations make signed instead of unsigned comparisons allowing a system crash.EPSS 1.7%CVE-2023-3635MEDIUMOkio GzipSource unhandled exception Denial of ServiceEPSS 1.3%CVE-2020-1913—An Integer signedness error in the JavaScript Interpreter in Facebook Hermes prior to commit 2c7af7ec481ceffd0d14ce2d7c045e475fd71dc6 allowsEPSS 1.2%CVE-2026-26981MEDIUMOpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cppEPSS 0.5%CVE-2025-49847HIGHllama.cpp Vulnerable to Buffer Overflow via Malicious GGUF ModelEPSS 0.4%CVE-2023-5184HIGHPotential signed to unsigned conversion errors and buffer overflow vulnerabilities in the Zephyr IPM driverEPSS 0.4%CVE-2026-62959HIGHCoturn: Pre-authentication heap memory disclosure in ACME redirect (`try_acme_redirect`)EPSS 0.4%CVE-2026-41682MEDIUMpupnp: Port truncation via atoi() cast in parse_uri() allows SSRF port confusionEPSS 0.3%CVE-2024-25388HIGHdrivers/wlan/wlan_mgmt,c in RT-Thread through 5.0.2 has an integer signedness error and resultant buffer overflow.EPSS 0.3%CVE-2025-52566HIGHllama.cpp tokenizer signed vs. unsigned heap overflowEPSS 0.3%CVE-2026-49840CRITICALFreeSWITCH: Pre-authentication heap buffer overflow in libesl `Content-Length` parsingEPSS 0.3%CVE-2025-67897MEDIUMIn Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue EPSS 0.3%CVE-2026-55991MEDIUMRemote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2EPSS 0.2%CVE-2025-30646HIGHJunos OS and Junos OS Evolved: Receipt of a malformed LLDP TLV results in l2cpd crashEPSS 0.2%CVE-2025-65495HIGHInteger signedness error in tls_verify_call_back() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of EPSS 0.2%CVE-2023-28063MEDIUM Dell BIOS contains a Signed to Unsigned Conversion Error vulnerability. A local authenticated malicious user with admin privileges could poEPSS 0.2%CVE-2026-55737MEDIUMHeap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoderEPSS 0.1%