Weakness (CWE)
CWE-191: Integer Underflow (Wrap or Wraparound)
The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
More detail
This can happen in signed and unsigned cases.
Source: MITRE CWE-191
157 results · Clear filters · Feed
-
Medium 5.2
TinyUSB < 0.20.1 Integer Underflow via HID Report Descriptor Parser
TinyUSB before 0.20.1 contains an integer underflow vulnerability in the HID host report descriptor parser tuh_hid_parse_report_descriptor() in src/class/hid/hid_host.c that allows a malicious USB device to trigger an out-of-bounds read by subtracting an item…
-
Medium 5.9
psqlODBC does not validate server-supplied counts and lengths
psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a size subtraction that can underflow. SQLStatistics iterates index keys using a server-supplied key count without bounding it to the fixe…
-
Medium 6.7
In afe, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of p…
-
Medium 6.7
In adsp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of pri…
-
Medium 5.5
smpeg through 2.0.0 Integer Underflow via stream_header in MPEGsystem.cpp
smpeg through 2.0.0 contains an integer underflow vulnerability in stream_header() in MPEGsystem.cpp that allows attackers to wrap packet_size by declaring an undersized packet length. Attackers can supply a crafted MPEG file opened via SMPEG_new, SMPEG_new_r…
-
Medium 6.5
Dpdk: dpdk: guest with runt rx descriptors underflows copy length in vhost enqueue (split and packed rings)
A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK.
-
Medium 5.9
Integer underflow of the radio-reported frame length causes an out-of-bounds write in the NXP KW41Z IEEE 802.15.4 driver
The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41z_rx() in drivers/ieee802154/ieee802154_kw41z.c, computed the payload size as pkt_len = len - KW41Z_FCS_LENGTH in a uint8_t, where len is the frame length reported by the radio. The interrupt handler…
-
Medium 5.4
Junos OS and Junos OS Evolved: EX Series, MX Series, ACX Series: An attacker causes rpd heap memory disclosure when Rosen-MVPN data-MDT is enabled
An Integer Underflow (Wrap or Wraparound) vulnerability in the rpd process of Juniper Networks Junos OS on EX Series and MX Series, and Junos OS Evolved on ACX Series allows an unauthenticated adjacent attacker to cause heap memory disclosure and multicast jo…
-
Medium 6.5
Junos OS and Junos OS Evolved: SRX Series: An attacker causes a forwarding-plane outage when SVR vector routing is used
An Integer Underflow (Wrap or Wraparound) vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an adjacent unauthenticated attacker to cause a forwarding-plane denial of service via an ICMP message associated …
-
Medium 6.5
libsmb2 through 6.2 Heap Out-of-Bounds Read via decode_acl Integer Underflow
libsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned sessions can send an …
-
Medium 5.3
An integer underflow exists in the DNS proxy component of the macOS NetworkExtension system extension shipped with Akam…
-
Medium 5.5
Windows NTFS Information Disclosure Vulnerability
Integer underflow (wrap or wraparound) in Windows NTFS allows an authorized attacker to disclose information locally.
-
Medium 6.5
Microsoft Office Excel Information Disclosure Vulnerability
Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
-
Medium 6.7
Windows Storage Spaces Controller Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.
-
Medium 6.5
Busybox: busybox: udhcpc integer underflow in dhcp packet length calculation causes denial of service
A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow…
-
Medium 6.5
odhcpd: pre-auth remote DoS via size_t underflow in dhcpv6_ia_handle_IAs (stack BOF, canary-terminated)
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain two bindings through normal DHCPv6 SOLICIT and REQUEST exchanges and then send a crafted RE…
-
Medium 6.5
FreeRDP before 3.32.0 Shadow Server Divide-by-Zero via Frame Acknowledge PDU
FreeRDP before 3.32.0 contains a divide-by-zero vulnerability in the freerdp-shadow-cli shadow server: the frame id in a client's Frame Acknowledge PDU is stored without a range check, so the in-flight frame count in shadow_encoder_inflight_frames() can under…
-
Medium 6.5
Application denial of service via malformed KMS endpoint in MongoDB libmongocrypt
An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that terminates the application process. This can occur when an authenticated user modifies a key document in the key vault collection, or when an …
-
Medium 6.2
Out-of-bounds read and write via undersized BSON buffer reservation in MongoDB C Driver
The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who c…
-
Medium 6.1
Dislocker through 0.7.3 Out-of-Bounds Heap Read via VMK/FVEK Datum Size Underflow
Dislocker through 0.7.3 contains an integer underflow vulnerability in get_vmk() and get_fvek() that allows attackers to trigger out-of-bounds heap reads via crafted datum sizes. Attackers can supply a malicious BitLocker volume image with a datum_size smalle…
-
Medium 6.1
Integer underflow in TightVNC Server cursor shape trimming leads to out-of-bounds read
An integer underflow in WinCursorShapeUtils::trimTransparent() in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to crash the server, and potentially read out-of-bounds memory, by causing a cursor shape with a width or he…
-
Medium 5.3
wstrncat() unsigned integer underflow leads to an off-by-one null write in wolfSSH on non-Windows platforms
Unsigned integer underflow in wstrncat() in src/port.c in wolfSSL wolfSSH from v1.4.11 through v1.5.0 on non-Windows platforms allows an authenticated remote attacker to write one out-of-bounds null byte past the end of a stack buffer by sending a crafted SFT…
-
Medium 6.5
Security Advisory 0194
On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled SSID can crash the portal service with a crafted HTTP request. This results in a temporary denial of service until the…
-
Medium 6.8
Integer underflow of net_buf length in the MCUmgr serial (SMP over console) transport leads to out-of-bounds read
The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length from it, verifies a CRC and then unconditionally strips the trailing CRC with rx_ctxt->nb->len -= 2U; in mcumgr_serial_process_frag() (subsys/mgmt/mcumgr/transport/src/…
-
Medium 5.1
This Power System update is being released to address
IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the partition firmware runtime. An attacker with root access to a partition can send …
-
Medium 6.2
Bento4 1.6.0.0 contains an integer underflow vulnerability in the avcC and hvcC configuration atom parsers. A specially…
-
Medium 6.3
JusticeRage Manalyze PE Parser pe.cpp _parse_debug integer underflow
A security flaw has been discovered in JusticeRage Manalyze 1.0.0. The affected element is the function PE::_parse_debug of the file manape/pe.cpp of the component PE Parser. The manipulation of the argument misc.Length results in integer underflow. The attac…
-
Medium 6.2
FluidSynth: SF2 DMOD Chunk Unsigned Underflow
FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the SF2 parser computes the DMOD modulator count as chunk.size / SF_MOD_SIZE - 1 without rejecting chunks smaller than one record. A crafted SF2 file contain…
-
Medium 5.3
Integer Underflow → Heap Out-of-Bounds Read in `bson_new_from_buffer()
A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify that the …
-
Medium 6.5
rabbitmq-c: size_t underflow in AMQP frame length computation leads to out-of-bounds read
rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized HEADER or METHOD frame during client login and cause unsigned size_t underflow in amqp_handle_input() in librabbitmq/amqp_connection.c…
-
Medium 5.1
HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities
HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, o…
-
Medium 4.0
Sssd: sssd: denial of service in nss responder via crafted zero-length requests
A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services (NSS) responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable…
-
Medium 6.9
Out-of-bounds read and integer underflow vulnerability in QNdefNfcTextRecord impacts Qt NFC module
An out-of-bounds read in Qt NFC's language code length parsing allows a physically proximate attacker to cause a denial of service or limited memory disclosure via a crafted NFC tag.
-
Medium 5.5
Acrobat Reader | Integer Underflow (Wrap or Wraparound) (CWE-191)
Acrobat Reader is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user …
-
Medium 6.5
Microsoft Windows SCSI Class System File Information Disclosure Vulnerability
Integer underflow (wrap or wraparound) in Microsoft Windows SCSI Class System File allows an unauthorized attacker to disclose information over a network.
-
Medium 5.5
Microsoft SQL Server Information Disclosure Vulnerability
Integer underflow (wrap or wraparound) in SQL Server allows an authorized attacker to disclose information locally.
-
Medium 5.5
Push Message Routing Service Information Disclosure Vulnerability
Out-of-bounds read in Push Message Routing Service allows an authorized attacker to disclose information locally.
-
Medium 6.4
Windows File History Service Elevation of Privilege Vulnerability
Integer underflow (wrap or wraparound) in Windows File History Service allows an authorized attacker to elevate privileges locally.
-
Medium 6.5
gitoxide gix-packetline before 0.21.5 Denial of Service
gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines with empty payloads. A malicious Git server can send a crafted side-band packet to trigger an index o…
-
Medium 5.3
wicked: integer underflow of the UDP length in ni_capture_inspect_udp_header() leads to an out-of-bounds read
An integer underflow was found in the DHCPv4 packet capture code of wicked. ni_capture_inspect_udp_header() in src/capture.c does not verify that the IP total length field (ip_len) is at least as large as the IP header length (ihl) before subtracting the head…