Weakness (CWE)
CWE-190: Integer Overflow or Wraparound
The product performs a calculation that can
produce an integer overflow or wraparound when the logic
assumes that the resulting value will always be larger than
the original value. This occurs when an integer value is
incremented to a value that is too large to store in the
associated representation. When this occurs, the value may
become a very small or negative number.
How to prevent it (7 mitigations)
-
Requirements
Ensure that all protocols are strictly defined, such that all out-of-bounds behavior can be identified simply, and require strict conformance to the protocol.
-
Requirements
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
If possible, choose a language or compiler that performs automatic bounds checking.
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
Use libraries or frameworks that make it easier to handle numbers without unexpected consequences.
Examples include safe integer handling packages such as SafeInt (C++) or IntegerLib (C or C++). [REF-106]
-
Implementation
Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.
Use unsigned integers where possible. This makes it easier to perform validation for integer overflows. When signed integers are required, ensure that the range check includes minimum values as well as maximum values.
-
Implementation
Understand the programming language's underlying representation and how it interacts with numeric calculation (CWE-681). Pay close attention to byte size discrepancies, precision, signed/unsigned distinctions, truncation, conversion and casting between types, "not-a-number" calculations, and how the language handles numbers that are too large or too small for its underlying representation. [REF-7]
Also be careful to account for 32-bit, 64-bit, and other potential differences that may affect the numeric representation.
-
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
-
Implementation
Examine compiler warnings closely and eliminate problems with potential security implications, such as signed / unsigned mismatch in memory operations, or use of uninitialized variables. Even if the weakness is rarely exploitable, a single failure may lead to the compromise of the entire system.
Source: MITRE CWE-190
2,069 results · Feed
-
Medium 6.1
Gimp: gimp: paa integer overflow out-of-bounds read
A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive (PAA) texture file. Due to an integer overflow when cal…
-
High 7.0
Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerability
A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker can trigger a heap-based…
-
High 7.5
JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS
JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries. Prior to 1.5.14, IPCameraFrameGrabber doubles a 32-bit buffer capacity without checking for overflow or bounding the parsed Content-Length. An application consumes an MJPEG res…
-
Critical 9.1
RIOT: Potential integer overflow in nanocoap Block2 handling leading to out-of-bounds memory access
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, nanocoap accepts oversized CoAP Block2 option values without enforcing the 20-bit maximum block number, allowing bloc…
-
High 7.1
pupnp: Integer truncation in HTTP Content-Length parsing enables request smuggling
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, raw_to_int in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before the caller stores it as un…
-
High 7.5
Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation
A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer ove…
-
High 8.8
FreeRDP 3.29.0 before 3.32.0 Heap Overflow via audin Apple Backends
FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the audio queue buffer size as FramesPerPacket * 2 * nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malic…
-
High 7.5
Integer overflow in OpenModSim (<=1.11.0), leading to denial of service
-
High 8.2
iso14229 before 0.10.1 Out-of-Bounds Read via Handle_0x38_RequestFileTransfer
Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle_0x38_RequestFileTransfer that lets unauthenticated attackers bypass the file path length check. Attackers can send a short RequestFileTransfer (SID 0x38) request with filePathAndNameL…
-
Medium 5.9
Integer overflow causes an infinite loop in message buffer growth in PgBouncer
Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service when max_packet_size is configured above 2147483648. A packet header declaring a length above 2^31 ma…
-
Medium 6.5
F´: SendPartial Integer Overflow Leading to Assertion DoS
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because the wrapping sum bypasses file-range validation, …
-
High 8.1
F´: File size bounds bypass in Svc::FileUplink via unsigned integer overflow in DATA packet validation
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FileUplink handleDataPacket offset and size validation is vulnerable because the component checks byteOffset plus…
-
Medium 6.5
Junos OS and Junos OS Evolved: Malformed OSPF packets causes routing disruption when OSPF is enabled
An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via specific OSPFv2 packets sent on an OSPF-enabled…
-
High 7.2
F´: FpySequencer Integer Overflow in Stack Offset/Size Validation Leading to Out-of-Bounds Write
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FpySequencer STORE directive stack write validation the bounds check adds attacker-controlled offset and size bef…
-
Medium 6.5
F´: FileDownlink SendPartial integer overflow lets legal startOffset/length values reach a reachable assertion
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because unchecked startOffset plus length arithmetic bypa…
-
High 7.5
Junos OS and Junos OS Evolved: An EVPN default-gateway route burst causes l2ald denial of service
An Integer Overflow or Wraparound vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows a configured EVPN BGP peer to cause a denial of service via EVPN Type-2 MAC/IP routes.
-
High 7.5
Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when BGP extended-nexthop-tunnel is used
An Integer Overflow or Wraparound vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated BGP peer to cause a denial of service via BGP route updates when extended-nexthop-tunnel is enabled.
-
High 7.5
Junos OS and Junos OS Evolved: An attacker causes routing daemon denial of service when EVPN BGP is enabled
An Integer Overflow or Wraparound vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a remote attacker with an established EVPN BGP peering relationship to cause a denial of service via EVPN BGP route processing. The iss…
-
High 7.5
Junos OS and Junos OS Evolved: An attacker causes a routing protocol daemon denial of service when EVPN is used
An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause a denial of service via specially crafted EVPN route updates from an accepted EVPN BGP peer.
-
High 8.0
util-linux libblkid DOS extended-partition overflow produces invalid partition metadata
util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to th…
-
Low 2.9
rapidcsv: Integer overflow in iterator arithmetic causes out-of-bounds access
rapidcsv is a C++ CSV parser library. Prior to 8.99, RemoveColumn, InsertColumn, RemoveRow, InsertRow, and GetColumnNames converted size_t indexes to int before adding them to std::vector iterators. On 64-bit systems, in a CSV matrix dimension containing more…
-
High 7.5
Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untr…
-
High 7.5
CAI Content Credentials | Integer Overflow or Wraparound (CWE-190)
CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Expl…
-
High 7.0
Microsoft SQL Server Elevation of Privilege Vulnerability
Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges locally.
-
High 7.8
Photoshop Desktop | Integer Overflow or Wraparound (CWE-190)
Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
-
High 7.8
Photoshop Desktop | Integer Overflow or Wraparound (CWE-190)
Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
-
Medium 4.3
IBM WebSphere Application Server Liberty Integer Overflow
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a Reader-role attacker to obtain version information that causes an uncaught exception.
-
High 7.8
Windows Graphics Kernel Elevation of Privilege Vulnerability
Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
-
High 8.8
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
-
High 8.8
.NET Framework Elevation of Privilege Vulnerability
Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.
-
High 8.8
Microsoft Office SharePoint Remote Code Execution Vulnerability
Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Word Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office SharePoint Remote Code Execution Vulnerability
Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
-
High 7.8
Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Resource Management (MRM) Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows Resource Management (MRM) allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Graphics Component Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Kernel Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Devices Human Interface Elevation of Privilege Vulnerability
Integer overflow or wraparound in HID Parser Library allows an authorized attacker to elevate privileges locally.
-
High 8.8
Microsoft Windows Search Component Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.