Weakness (CWE)
CWE-190: Integer Overflow or Wraparound
The product performs a calculation that can
produce an integer overflow or wraparound when the logic
assumes that the resulting value will always be larger than
the original value. This occurs when an integer value is
incremented to a value that is too large to store in the
associated representation. When this occurs, the value may
become a very small or negative number.
How to prevent it (7 mitigations)
-
Requirements
Ensure that all protocols are strictly defined, such that all out-of-bounds behavior can be identified simply, and require strict conformance to the protocol.
-
Requirements
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
If possible, choose a language or compiler that performs automatic bounds checking.
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
Use libraries or frameworks that make it easier to handle numbers without unexpected consequences.
Examples include safe integer handling packages such as SafeInt (C++) or IntegerLib (C or C++). [REF-106]
-
Implementation
Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.
Use unsigned integers where possible. This makes it easier to perform validation for integer overflows. When signed integers are required, ensure that the range check includes minimum values as well as maximum values.
-
Implementation
Understand the programming language's underlying representation and how it interacts with numeric calculation (CWE-681). Pay close attention to byte size discrepancies, precision, signed/unsigned distinctions, truncation, conversion and casting between types, "not-a-number" calculations, and how the language handles numbers that are too large or too small for its underlying representation. [REF-7]
Also be careful to account for 32-bit, 64-bit, and other potential differences that may affect the numeric representation.
-
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
-
Implementation
Examine compiler warnings closely and eliminate problems with potential security implications, such as signed / unsigned mismatch in memory operations, or use of uninitialized variables. Even if the weakness is rarely exploitable, a single failure may lead to the compromise of the entire system.
Source: MITRE CWE-190
1,110 results · Clear filters · Feed
-
High 8.8
Microsoft Office Visio Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
-
High 8.8
HEVC Video Extensions Remote Code Execution Vulnerability
Integer overflow or wraparound in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.
-
High 8.4
Integer overflow in libmime buffer growth could lead to heap corruption
Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent memcpy would…
-
High 7.1
CvFWD Denial of Service
CvFWD contained an integer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale
-
High 7.1
UEFI OOB Write and Buffer Overflow Vulnerabilities
AMI APTIOV contains vulnerabilities in BIOS where users may cause “Integer Overflow or Wraparound” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact …
-
High 8.8
Integer overflow in the Graphics component
Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
-
High 7.0
OpenS100 S-102 Parser Integer Overflow Heap Buffer Overflow
OpenS100 through commit 2b1dafc contains an integer overflow vulnerability in the S-102 Bathymetric Surface parser. An attacker can supply a crafted S-102 HDF5 file with malicious grid dimension metadata that causes memory corruption when a user opens it. In …
-
High 7.8
An issue in mp4v2 2.0.0 allows an attacker to execute arbitrary code via the MP4RtpAtom::ReadHntiType() in src/atom_rtp…
-
High 8.8
Integer overflow in dynamic kernel object allocation allows user-mode threads to corrupt the kernel heap
dynamic_object_create() in kernel/userspace/userspace.c computed the backing allocation for a dynamically allocated kernel object as obj_size_get(otype) + size, and for thread stack elements as STACK_ELEMENT_DATA_SIZE(size) (a round-up plus fixed overhead), w…
-
High 7.5
Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0 in github.com/xuri/excelize/v2 and from 1.1.0 to 1.4.1 in github.com/xuri/excelize, ColumnNameToNumber accumulates a bijective base-26 value in int64 …
-
High 7.8
libmikmod before 3.3.14 Heap Buffer Overflow via OKT Loader OKT_doPBOD
libmikmod before 3.3.14 contains an integer overflow in the Oktalyzer loader OKT_doPBOD() that allows attackers to cause heap buffer overflow via crafted track counts. Attackers can supply an OKT module whose SLEN chunk wraps the 16-bit numtrk value, causing …
-
High 7.8
libmikmod before 3.3.14 Heap Buffer Overflow via DSM Loader Integer Overflow
libmikmod before 3.3.14 contains an integer overflow vulnerability in DSM_Load() in load_dsm.c that allows attackers to trigger heap buffer overflow via crafted track counts. Attackers can supply a DSM module whose numchn and numpat product wraps a 16-bit val…
-
High 7.8
In rw_t4t_update_file of rw_t4t.cc, there is a possible out-of-bounds write due to an integer overflow. This could lead…
-
High 8.7
Apache Thrift: PHP accelerator sizes a stack buffer from a wire-controlled string length
Stack-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in Apache Thrift php bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
-
High 8.8
Apache HTTP Server: mod_dav_fs namespace overflow
Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces.
-
High 7.5
Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol
Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol. Nothing range-checks raw_datachannels. The line buffer is sized as the image width times the channel count with no overfl…
-
High 7.8
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause an in…
-
High 7.8
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an unprivileged…
-
High 7.8
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could c…
-
High 7.8
NVIDIA vGPU Virtual GPU Manager for Windows and Linux contains a vulnerability in the kernel mode layer, where a guest …
-
High 7.5
Apache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificate extensions
An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes…
-
High 8.7
Apache PLC4X: Go binding: unbounded allocation and framing failures on wire-controlled lengths
Integer Overflow, Improper Validation of Array Index, Uncontrolled Recursion and Memory Allocation with Excessive Size Value in the Go implementation of Apache PLC4X (PLC4Go) allow a malicious device, or an attacker able to inject network traffic, to crash or…
-
High 7.5
Integer Overflow or Wraparound and Out-of-bounds Write in compress
compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding Max…
-
High 7.8
NVIDIA DeepStream contains a vulnerability where an attacker could cause an integer overflow by supplying crafted tenso…
-
High 7.5
Esri Lerc has a security vulnerability
Esri LERC is an open-source image or raster format which supports rapid encoding and decoding for any pixel type. A Heap based Out-of-Bounds Write via Integer Overflow in LERC versions 4.1.0 and earlier may allow a remote, unauthenticated attacker who can pas…
-
High 7.5
Microsoft Office Outlook Remote Code Execution Vulnerability
Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
-
High 8.4
Heap out-of-bounds write via signed size overflow in BSON document encoding
An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-b…
-
High 7.5
libsndfile 1.2.2 contains an integer overflow vulnerability in mat4_read_header() when parsing crafted MAT4 (MATLAB v4)…
-
High 7.5
SumatraPDF 3.6.1 contains an integer overflow vulnerability in EngineMupdf::BuildPageLabelRec() when parsing PDF PageLa…
-
High 7.5
Integer overflow causes an infinite loop in packet buffer growth in PgBouncer
Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to cause a denial of service. Sufficiently large input makes the buffer size computation overflow, leaving the growth loop unable to termi…
-
High 7.3
Integer Overflow or Wraparound, Improper Access Control vulnerability in RTI Connext Professional (Core Libraries) allows Shared Resource Manipulation.
Integer Overflow or Wraparound, Improper Access Control vulnerability in RTI Connext Professional (Core Libraries) allows Shared Resource Manipulation. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 b…
-
High 7.7
Gcc: libstdc++ integer overflow in `new` operator
A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application in…
-
High 8.8
IBM MQ queue manager is vulnerable to privilege escalation
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in MQINQ request processing.
-
High 7.8
virtio-win: Integer overflow causing a heap overflow in Viosock driver
virtio-win provides Windows paravirtualized drivers for QEMU and KVM. From mm210 until mm320, the Viosock driver permits a low-privilege local process to submit an IOCTL_SELECT request with attacker-controlled VIRTIO_VSOCK_SELECT.Fdss[*].fd_count values that …
-
High 8.8
IBM MQ queue manager is vulnerable to remote code execution
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in distribution list processing.
-
High 7.5
Integer Overflow or Wraparound in µD3TN
Integer overflow in µD3TN v0.15.0 TCPCLv3 handshake causes heap overflow, allowing remote attackers to reliably cause DoS
-
High 8.7
ESPAsyncWebServer: Integer overflow in multipart boundary parser causes denial of service
ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to 3.11.1, the multipart/form-data parser in src/WebRequest.cpp stores _boundaryPosition as an 8-bit value while _parseMultipartPostByte proces…
-
High 7.8
Integer Overflow or Wraparound in OOBM
Memory Corruption when validating large data buffers from external sources using addition to check buffer length.
-
High 7.5
Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799)
Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.5 and 7.0.0-alpha04, Wire protobuf readers do not consistently validate attacker-controlled lengths against the current logical message boundary before advancing cursor…
-
High 7.8
Gimp: integer overflow when generating a thumbnail preview for a psd file
A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD (Photoshop Document) image file, an integer overflow occurs during the multiplication of values from an embedded JPEG header. This leads to an und…