Weakness (CWE)
CWE-190: Integer Overflow or Wraparound
The product performs a calculation that can
produce an integer overflow or wraparound when the logic
assumes that the resulting value will always be larger than
the original value. This occurs when an integer value is
incremented to a value that is too large to store in the
associated representation. When this occurs, the value may
become a very small or negative number.
How to prevent it (7 mitigations)
-
Requirements
Ensure that all protocols are strictly defined, such that all out-of-bounds behavior can be identified simply, and require strict conformance to the protocol.
-
Requirements
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
If possible, choose a language or compiler that performs automatic bounds checking.
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
Use libraries or frameworks that make it easier to handle numbers without unexpected consequences.
Examples include safe integer handling packages such as SafeInt (C++) or IntegerLib (C or C++). [REF-106]
-
Implementation
Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.
Use unsigned integers where possible. This makes it easier to perform validation for integer overflows. When signed integers are required, ensure that the range check includes minimum values as well as maximum values.
-
Implementation
Understand the programming language's underlying representation and how it interacts with numeric calculation (CWE-681). Pay close attention to byte size discrepancies, precision, signed/unsigned distinctions, truncation, conversion and casting between types, "not-a-number" calculations, and how the language handles numbers that are too large or too small for its underlying representation. [REF-7]
Also be careful to account for 32-bit, 64-bit, and other potential differences that may affect the numeric representation.
-
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
-
Implementation
Examine compiler warnings closely and eliminate problems with potential security implications, such as signed / unsigned mismatch in memory operations, or use of uninitialized variables. Even if the weakness is rarely exploitable, a single failure may lead to the compromise of the entire system.
Source: MITRE CWE-190
2,072 results · Feed
-
Medium 5.7
PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a…
-
Medium 4.4
Gstreamer1-plugins-good: gstreamer: integer overflow and out-of-bounds read in qtdemux cea-608 closed-caption parser
A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This…
-
High 8.7
Netskope Endpoint DLP Driver Integer Overflow Leading to Kernel Pool Overflow
Netskope was notified about a potential gap in Netskope Endpoint DLP (EPDLP) running on Windows systems. Successful exploitation of the gap could potentially allow a privileged user to send a crafted message to the EPDLP process port to trigger an integer ove…
-
Medium 4.7
Heap buffer overflow via wrapped size check during SASL username canonicalization in MongoDB C Driver
A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the applic…
-
Critical 9.1
Integer overflow in tensor buffer validation in Deep Java Library
An integer overflow in the tensor buffer validation component in Amazon Deep Java Library (DJL) from 0.13.0 through 0.36.0 on all platforms might allow a remote unauthenticated actor to obtain information from adjacent process memory or cause a denial of serv…
-
Medium 5.3
rclone local: crafted Range request against a translated symlink panics (DoS)
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unche…
-
High 8.2
zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size Methods
zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MIN_VALUE to …
-
High 7.0
VLC media player 3.0.0 through 3.0.23 memory corruption vulnerability
VLC media player versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing crafted media. Exploitation requires user interaction and may result in application termination or code execution with the privileges of the VLC pro…
-
Critical 9.6
Integer overflow in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to potentially …
-
Medium 4.3
Integer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the …
-
High 7.8
Acrobat Reader | Integer Overflow or Wraparound (CWE-190)
Acrobat Reader is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
-
High 7.8
Photoshop Desktop | Integer Overflow or Wraparound (CWE-190)
Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
-
High 7.8
Photoshop Desktop | Integer Overflow or Wraparound (CWE-190)
Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
-
High 7.8
Photoshop Desktop | Integer Overflow or Wraparound (CWE-190)
Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
-
High 7.8
Photoshop Desktop | Integer Overflow or Wraparound (CWE-190)
Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
-
High 7.8
In multiple locations, there is a possible out of bounds write due to an integer overflow. This could lead to local esc…
-
High 7.8
In tt_face_colr_blend_layer of ttcolr.c, there is a possible remote code execution due to an integer overflow. This cou…
-
Medium 4.3
In convertCleanApertureToRect of HeifCleanAperture.cpp, there is a possible way to cause a temporary denial of service …
-
High 7.8
Microsoft Graphics Component Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to execute code locally.
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
High 8.8
Microsoft SQL Server Remote Code Execution Vulnerability
Integer overflow or wraparound in SQL Server allows an unauthorized attacker to execute code over a network.
-
High 7.8
Windows Biometric Service Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Biometric Service Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Biometric Service Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
-
High 8.8
Windows Imaging Component Remote Code Execution Vulnerability
Integer overflow or wraparound in Windows Imaging Component allows an unauthorized attacker to execute code over a network.
-
High 7.8
Windows Biometric Service Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Biometric Service Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Biometric Service Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Biometric Service Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows USB Video Driver Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.
-
Critical 9.8
Microsoft Windows PDF Remote Code Execution Vulnerability
Integer overflow or wraparound in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network.
-
High 7.8
Volume Manager Driver Elevation of Privilege Vulnerability
Integer overflow or wraparound in Volume Manager Driver allows an authorized attacker to elevate privileges locally.
-
Medium 6.7
Windows Overlay Filter Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
-
High 7.5
BranchCache Denial of Service Vulnerability
Out-of-bounds read in BranchCache allows an unauthorized attacker to deny service over a network.
-
High 8.8
Windows DHCP Server Remote Code Execution Vulnerability
Integer overflow or wraparound in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
-
High 7.1
Microsoft Standard XPS Elevation of Privilege Vulnerability
Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network.
-
Medium 6.5
Microsoft SQL Server Denial of Service Vulnerability
Integer overflow or wraparound in SQL Server allows an authorized attacker to deny service over a network.
-
High 8.8
Microsoft SQL Server Remote Code Execution Vulnerability
Integer overflow or wraparound in SQL Server allows an authorized attacker to execute code over a network.