Weakness (CWE)
CWE-190: Integer Overflow or Wraparound
The product performs a calculation that can
produce an integer overflow or wraparound when the logic
assumes that the resulting value will always be larger than
the original value. This occurs when an integer value is
incremented to a value that is too large to store in the
associated representation. When this occurs, the value may
become a very small or negative number.
How to prevent it (7 mitigations)
-
Requirements
Ensure that all protocols are strictly defined, such that all out-of-bounds behavior can be identified simply, and require strict conformance to the protocol.
-
Requirements
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
If possible, choose a language or compiler that performs automatic bounds checking.
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
Use libraries or frameworks that make it easier to handle numbers without unexpected consequences.
Examples include safe integer handling packages such as SafeInt (C++) or IntegerLib (C or C++). [REF-106]
-
Implementation
Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.
Use unsigned integers where possible. This makes it easier to perform validation for integer overflows. When signed integers are required, ensure that the range check includes minimum values as well as maximum values.
-
Implementation
Understand the programming language's underlying representation and how it interacts with numeric calculation (CWE-681). Pay close attention to byte size discrepancies, precision, signed/unsigned distinctions, truncation, conversion and casting between types, "not-a-number" calculations, and how the language handles numbers that are too large or too small for its underlying representation. [REF-7]
Also be careful to account for 32-bit, 64-bit, and other potential differences that may affect the numeric representation.
-
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
-
Implementation
Examine compiler warnings closely and eliminate problems with potential security implications, such as signed / unsigned mismatch in memory operations, or use of uninitialized variables. Even if the weakness is rarely exploitable, a single failure may lead to the compromise of the entire system.
Source: MITRE CWE-190
1,100 results · Clear filters · Feed
-
High 8.1
node-fontnik: integer-overflow heap out-of-bounds write in RenderSDF
node-fontnik is a library that delivers a range of glyphs rendered as SDFs (signed distance fields) in a protocol buffer. Prior to version 0.7.7, a crafted font could trigger a heap out-of-bounds write in RenderSDF (include/mapbox/glyph_foundry_impl.hpp). Ren…
-
High 7.5
In StartTimer of UcePublishManager.cpp, there is a possible way to trigger a process abort during timer calculation due…
-
High 7.5
Microsoft Office Outlook Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Excel Remote Code Execution Vulnerability
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
-
High 7.5
Windows Graphics Kernel Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Microsoft Account Sign-in Assistant Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Microsoft Account Sign-in Assistant allows an authorized attacker to elevate privileges locally.
-
High 8.8
Microsoft XPS Document Converter Elevation of Privilege Vulnerability
Heap-based buffer overflow in Microsoft XPS Document Converter allows an unauthorized attacker to elevate privileges over a network.
-
High 7.5
Remote Desktop Client Remote Code Execution Vulnerability
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
-
High 7.0
Windows Installer Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
-
High 8.8
Microsoft Office Outlook Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
-
High 7.5
Microsoft Office Outlook Remote Code Execution Vulnerability
Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Word Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
High 7.8
Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.
-
High 8.8
Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows CD-ROM Driver Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows CD-ROM Driver allows an authorized attacker to elevate privileges locally.
-
High 7.5
Windows DNS Information Disclosure Vulnerability
Integer overflow or wraparound in Windows DNS allows an unauthorized attacker to disclose information over a network.
-
High 7.5
Microsoft JScript Remote Code Execution Vulnerability
Integer overflow or wraparound in Microsoft JScript allows an unauthorized attacker to execute code over a network.
-
High 7.0
Windows Network Connection Broker Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Installer Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows Installer allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows File Server Resource Management Service Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows File Server Resource Management Service allows an authorized attacker to elevate privileges locally.
-
High 7.5
Microsoft Windows Codecs Library Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.
-
High 7.0
Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
-
High 7.5
Windows JScript Remote Code Execution Vulnerability
Integer overflow or wraparound in Microsoft JScript allows an unauthorized attacker to execute code over a network.
-
High 7.5
Windows SMBv3 Server Remote Code Execution Vulnerability
Integer overflow or wraparound in Windows SMB Server allows an authorized attacker to execute code over a network.
-
High 7.8
Windows Overlay Filter Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows Overlay Filter allows an unauthorized attacker to elevate privileges locally.
-
High 7.8
Windows Installer Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows Installer allows an authorized attacker to elevate privileges locally.
-
High 7.8
Microsoft DirectMusic Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Microsoft DirectMusic allows an authorized attacker to execute code locally.
-
High 7.5
Windows DHCP Server Denial of Service Vulnerability
Uncontrolled resource consumption in Windows DHCP Server allows an unauthorized attacker to deny service over a network.
-
High 7.0
Microsoft Color Management Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Color Management allows an unauthorized attacker to execute code locally.
-
High 7.8
Windows Graphics Kernel Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows GDI Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows GDI allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Local Security Authority Subsystem Service (LSASS) Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally.
-
High 8.6
Integer overflow in the UEFI firmware for the Intel(R) Slim Bootloader within Ring 0: Bare Metal OS may allow an escala…
-
High 7.4
rabbitmq-c: amqp_decode_bytes size_t integer overflow bypasses bounds check on 32-bit (OOB read)
rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, the bounds check (*offset = o + len) <= encoded.len overflows when o + len > SIZE_MAX on 32-bit systems. len is a uint32_t read from the AMQP wire as a BYTES/UTF8 field leng…
-
High 7.0
Integer Overflow Vulnerability in Hitachi Dynamic Link Manager for AIX (for the Japanese market)
Integer Overflow Vulnerability in Hitachi Dynamic Link Manager for AIX (for the Japanese market). This issue affects Hitachi Dynamic Link Manager for AIX: before 9.0.4-01.
-
High 8.1
Integer Overflow Vulnerability in Hitachi Dynamic Link Manager for VMware
Integer Overflow Vulnerability in Hitachi Dynamic Link Manager for VMware. This issue affects Hitachi Dynamic Link Manager for VMware: from 8.7.3-00 before 9.0.4-01.
-
High 7.5
Multiple Vulnerabilities in SAP NetWeaver (Internet Graphics Service)
SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming requests. An unauthenticated user could send a specially crafted request causing the affected process to read beyond the declared values, resulting i…
-
High 7.8
FFmpeg before 8.1.3 and 9.x before 9.0.2 Heap Out-of-Bounds Write via APAC Decoder
FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap out-of-bounds write vulnerability in the APAC decoder in libavcodec/apac.c caused by an unreset bitstream index. Attackers can supply a crafted APAC file whose growing bitstream_index triggers an intege…
-
High 7.8
FFmpeg through 9.0.2 Heap Buffer Overflow via ProRes prores_ks Encoder
FFmpeg through 9.0.2 contains an integer overflow vulnerability in ff_prores_kostya_encode_init() that miscalculates frame_size_upper_bound using 32-bit arithmetic for large frame dimensions. Attackers can supply a high-resolution video transcoded with the pr…
-
High 7.0
FFmpeg through 9.0.2 VVC Decoder Heap Out-of-Bounds Write via refs.c
FFmpeg through 9.0.2 contains an integer overflow vulnerability in the VVC decoder alloc_frame() function in libavcodec/vvc/refs.c that undersizes the reference picture list allocation on 32-bit builds. Attackers can supply a crafted VVC (H.266) file with a v…