Weakness (CWE)
CWE-190: Integer Overflow or Wraparound
The product performs a calculation that can
produce an integer overflow or wraparound when the logic
assumes that the resulting value will always be larger than
the original value. This occurs when an integer value is
incremented to a value that is too large to store in the
associated representation. When this occurs, the value may
become a very small or negative number.
How to prevent it (7 mitigations)
-
Requirements
Ensure that all protocols are strictly defined, such that all out-of-bounds behavior can be identified simply, and require strict conformance to the protocol.
-
Requirements
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
If possible, choose a language or compiler that performs automatic bounds checking.
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
Use libraries or frameworks that make it easier to handle numbers without unexpected consequences.
Examples include safe integer handling packages such as SafeInt (C++) or IntegerLib (C or C++). [REF-106]
-
Implementation
Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.
Use unsigned integers where possible. This makes it easier to perform validation for integer overflows. When signed integers are required, ensure that the range check includes minimum values as well as maximum values.
-
Implementation
Understand the programming language's underlying representation and how it interacts with numeric calculation (CWE-681). Pay close attention to byte size discrepancies, precision, signed/unsigned distinctions, truncation, conversion and casting between types, "not-a-number" calculations, and how the language handles numbers that are too large or too small for its underlying representation. [REF-7]
Also be careful to account for 32-bit, 64-bit, and other potential differences that may affect the numeric representation.
-
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
-
Implementation
Examine compiler warnings closely and eliminate problems with potential security implications, such as signed / unsigned mismatch in memory operations, or use of uninitialized variables. Even if the weakness is rarely exploitable, a single failure may lead to the compromise of the entire system.
Source: MITRE CWE-190
1,110 results · Clear filters · Feed
-
High 8.1
Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution or Denial-of-Service in HPE Networking EdgeConnect SD-WAN Gateways
A vulnerability exists in the proxy packet processing logic of the affected component where it improperly processes malformed or truncated input. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input that tri…
-
High 7.8
In VPU, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of priv…
-
High 8.4
In multiple locations, there is a possible permission bypass due to an integer overflow. This could lead to local escal…
-
High 7.3
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS …
-
High 7.5
An integer overflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Se…
-
High 8.8
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in Safari 26.6.1, iOS 26.…
-
High 8.8
An integer overflow was addressed with improved input validation. This issue is fixed in Safari 26.6.1, iOS 26.6.1 and …
-
High 7.3
marcobambini Gravity udp json-parser gravity_json.c integer overflow
A security vulnerability has been detected in marcobambini Gravity up to 0.9.7. This affects an unknown function of the file src/utils/gravity_json.c of the component udp json-parser. Such manipulation leads to integer overflow. The attack may be performed fr…
-
High 7.3
embedded-graphics image_raw.rs draw_sub_image integer overflow
A vulnerability was determined in embedded-graphics up to 0.8.2. This affects the function ImageRaw::draw_sub_image of the file src/image/image_raw.rs. Executing a manipulation of the argument width can lead to integer overflow. The attack may be launched rem…
-
High 7.4
libde265: SAO sequential filter heap buffer overflow via signed integer overflow
libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate the sample adaptive offset input-buffer size, allowing a crafted HEVC stream with large dimensions and 16-bit luma samples to…
-
High 7.4
libde265: Pixel accessor signed integer overflow causes heap OOB read/write
libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate pixel offsets, allowing a crafted HEVC stream with large image dimensions to trigger an integer overflow and cause out-of-bou…
-
High 8.1
Orthanc DICOM Server Integer Overflow or Wraparound
An integer overflow in a specified pitch and buffer-size computation leads to a heap out-of-bounds write when Orthanc DICOM Server decodes an attacker-supplied PNG.
-
High 7.5
libp2p-rendezvous through 0.17.1 Denial of Service via Unbounded Registration TTL in Discovery Responses
libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow. A malicious rendezvous server can send a discovery response with an unbounded TTL value that causes the…
-
High 8.7
Netskope Endpoint DLP Driver Integer Overflow Leading to Kernel Pool Overflow
Netskope was notified about a potential gap in Netskope Endpoint DLP (EPDLP) running on Windows systems. Successful exploitation of the gap could potentially allow a privileged user to send a crafted message to the EPDLP process port to trigger an integer ove…
-
High 8.2
zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size Methods
zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MIN_VALUE to …
-
High 7.0
VLC media player 3.0.0 through 3.0.23 memory corruption vulnerability
VLC media player versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing crafted media. Exploitation requires user interaction and may result in application termination or code execution with the privileges of the VLC pro…
-
High 7.8
Acrobat Reader | Integer Overflow or Wraparound (CWE-190)
Acrobat Reader is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
-
High 7.8
Photoshop Desktop | Integer Overflow or Wraparound (CWE-190)
Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
-
High 7.8
Photoshop Desktop | Integer Overflow or Wraparound (CWE-190)
Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
-
High 7.8
Photoshop Desktop | Integer Overflow or Wraparound (CWE-190)
Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
-
High 7.8
Photoshop Desktop | Integer Overflow or Wraparound (CWE-190)
Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
-
High 7.8
In multiple locations, there is a possible out of bounds write due to an integer overflow. This could lead to local esc…
-
High 7.8
In tt_face_colr_blend_layer of ttcolr.c, there is a possible remote code execution due to an integer overflow. This cou…
-
High 7.8
Microsoft Graphics Component Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to execute code locally.
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
High 8.8
Microsoft SQL Server Remote Code Execution Vulnerability
Integer overflow or wraparound in SQL Server allows an unauthorized attacker to execute code over a network.
-
High 7.8
Windows Biometric Service Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Biometric Service Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Biometric Service Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
-
High 8.8
Windows Imaging Component Remote Code Execution Vulnerability
Integer overflow or wraparound in Windows Imaging Component allows an unauthorized attacker to execute code over a network.
-
High 7.8
Windows Biometric Service Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Biometric Service Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Biometric Service Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Biometric Service Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows USB Video Driver Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.
-
High 7.8
Volume Manager Driver Elevation of Privilege Vulnerability
Integer overflow or wraparound in Volume Manager Driver allows an authorized attacker to elevate privileges locally.
-
High 7.5
BranchCache Denial of Service Vulnerability
Out-of-bounds read in BranchCache allows an unauthorized attacker to deny service over a network.
-
High 8.8
Windows DHCP Server Remote Code Execution Vulnerability
Integer overflow or wraparound in Windows DHCP Server allows an unauthorized attacker to execute code over a network.