Weakness (CWE)
CWE-197: Numeric Truncation Error
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.
How to prevent it (1 mitigation)
-
Implementation
Ensure that no casts, implicit or explicit, take place that move from a larger size primitive or a smaller size primitive.
Source: MITRE CWE-197
100 results · Feed
-
Low 1.7
Integer truncation vulnerability in QTextCodec conversion functions impacts Qt Framework
An integer truncation vulnerability in the QTextCodec conversion functions of the Qt 5 Core Compatibility APIs module impacts the Qt Framework. An application using the affected functionality could crash.
-
High 7.5
An integer truncation vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthentica…
-
Medium 4.4
HTSlib through 1.24 Heap Out-of-Bounds Write via Truncated .gzi Index Count
HTSlib through 1.24 contains a heap out-of-bounds write and read vulnerability in bgzf_index_load_hfile() in bgzf.c that allows attackers to corrupt heap memory by supplying a crafted .gzi index entry count. A count of 0xFFFFFFFF truncates noffs to zero, caus…
-
Low 3.6CVE-2026-116012 Public exploit
Ghidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser
Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, such as a malicious .sl…
-
Critical 9.9CVE-2026-115889 Public exploit
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with ma…
-
High 8.8
Numeric truncation in the MPU buffer authorization check in FreeRTOS-Kernel
Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port might allow, under certain conditions, an unprivileged task on MPU-enabled builds to read or …
-
High 8.8
Microsoft Office Word Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Word Remote Code Execution Vulnerability
Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
High 7.0
Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability
Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Telegram. User interaction is required to exploit this vulnerability in that the target …
-
High 7.5
Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP Prefix-SID routes are re-advertised
A Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a BGP Prefix-SID route advertisement that is subsequently re-advert…
-
Medium 6.5
Junos OS and Junos OS Evolved: An attacker causes a routing-process crash when MPLS-TE fast reroute is enabled
A Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to crash the routing process via MPLS-TE fast-reroute signaling.
-
Critical 9.8
Windows Domain Name Service Remote Code Execution Vulnerability
Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network.
-
High 8.8
Windows Text Shaping Remote Code Execution Vulnerability
Out-of-bounds read in Windows Text Shaping allows an unauthorized attacker to execute code over a network.
-
High 7.0
Windows Client License Service Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Client License Service allows an authorized attacker to elevate privileges locally.
-
High 7.8
Microsoft Office Word Elevation of Privilege Vulnerability
Stack-based buffer overflow in Microsoft Office Word allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Installer Elevation of Privilege Vulnerability
Numeric truncation error in Windows Installer allows an authorized attacker to elevate privileges locally.
-
High 7.8
Microsoft Windows Search Component Elevation of Privilege Vulnerability
Numeric truncation error in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
-
High 7.8
Microsoft Graphics Component Elevation of Privilege Vulnerability
Numeric truncation error in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
-
Medium 6.3
apko /etc/passwd and /etc/group UID/GID truncation writes package-supplied entries as root
apko allows users to build and publish OCI container images built from apk packages. From version 0.2.0 to before version 1.4.5, UserEntry.Parse and GroupEntry.Parse in pkg/passwd read the UID and GID fields of /etc/passwd and /etc/group entries with strconv.…
-
Medium 6.5
Nezha before 2.3.8 Denial of Service via Alert Rule
Nezha before 2.3.8 fails to validate alert rule type and duration bounds, allowing authenticated non-administrator users to create malformed rules that trigger unrecovered panics in the alert evaluator goroutine. Attackers can submit a crafted alert rule via …
-
High 7.5
Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems
The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer…
-
Low 3.7
Suricata sip: large SIP message bodies can evade detection with frame keyword
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SIP parser in rust/src/sip/parser.rs stores request and response body lengths in 16-bit fields. A SIP body larger…
-
High 7.5
Remote assertion failure via 16-bit length truncation in `dns_ncache_add()`
If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts. This issue affects BIND 9 vers…
-
Medium 4.6
Out-of-bounds read (buffer over-read) vulnerability in HTTP Cache-Control response header parsing impacts Qt Framework (QtNetwork module)
Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through 6.8.8, and 6.9.0 through 6.11.1, allows remote attackers to cause a denial of service (application crash) via an exces…
-
Critical 9.6
Numeric truncation error in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially exec…
-
High 8.8
Microsoft Office Word Remote Code Execution Vulnerability
Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
High 7.8
Windows Spaceport.sys Elevation of Privilege Vulnerability
Numeric truncation error in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.
-
High 8.0
Windows Spaceport.sys Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Spaceport.sys allows an authorized attacker to elevate privileges over a network.
-
High 7.0
Windows Kernel Elevation of Privilege Vulnerability
Numeric truncation error in Windows Kernel allows an authorized attacker to elevate privileges locally.
-
Medium 5.5
Internet Storage Name Service Information Disclosure Vulnerability
Numeric truncation error in Internet Storage Name Service allows an authorized attacker to disclose information locally.
-
High 8.0
Windows Win32k Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges over a network.
-
High 7.8
Windows Kerberos Elevation of Privilege Vulnerability
Numeric truncation error in Windows Kerberos allows an authorized attacker to elevate privileges locally.
-
Medium 6.2
An out-of-bounds write caused by numeric truncation Samsung Open Source Escargot on Linux x86-64 allows an attacker who…
-
Medium 4.0
An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS label's length…
-
Medium 5.3
Libsoup: libsoup: integer truncation in sort_ranges() comparator causes silent omission of http range responses
A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes …
-
Low 2.4
Numeric Truncation Error in nnn
nnn stores homelen variable as uchar_t, which can only represent values in the range 0-255. An attacker who can influence the victim's execution environment can provide an arbitrary HOME path with length that is truncated to 0. The expression (homelen - 1) is…
-
High 7.5
COVESA Open1722 0.9.2 Stack Memory Disclosure via acf-can-listener.c Integer Truncation
COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a…
-
Low 2.0
Capstone WASM `br_table` instruction-size truncation can cause no-progress disassembly and parser desynchronization
Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public `cs_disasm()` and `cs_disasm_iter()` APIs. For a large but well-formed `br_table` inst…
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Numeric truncation error in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
Medium 6.7
Windows DNS Elevation of Privilege Vulnerability
Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.