Weakness (CWE)
CWE-197: Numeric Truncation Error
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.
How to prevent it (1 mitigation)
-
Implementation
Ensure that no casts, implicit or explicit, take place that move from a larger size primitive or a smaller size primitive.
Source: MITRE CWE-197
114 results · Feed
-
High 7.8
Windows Spaceport.sys Elevation of Privilege Vulnerability
Numeric truncation error in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.
-
High 8.0
Windows Spaceport.sys Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Spaceport.sys allows an authorized attacker to elevate privileges over a network.
-
High 7.0
Windows Kernel Elevation of Privilege Vulnerability
Numeric truncation error in Windows Kernel allows an authorized attacker to elevate privileges locally.
-
Medium 5.5
Internet Storage Name Service Information Disclosure Vulnerability
Numeric truncation error in Internet Storage Name Service allows an authorized attacker to disclose information locally.
-
High 8.0
Windows Win32k Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges over a network.
-
High 7.8
Windows Kerberos Elevation of Privilege Vulnerability
Numeric truncation error in Windows Kerberos allows an authorized attacker to elevate privileges locally.
-
Medium 6.2
An out-of-bounds write caused by numeric truncation Samsung Open Source Escargot on Linux x86-64 allows an attacker who…
-
Medium 4.0
An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS label's length…
-
Medium 5.3
Libsoup: libsoup: integer truncation in sort_ranges() comparator causes silent omission of http range responses
A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes …
-
Low 2.4
Numeric Truncation Error in nnn
nnn stores homelen variable as uchar_t, which can only represent values in the range 0-255. An attacker who can influence the victim's execution environment can provide an arbitrary HOME path with length that is truncated to 0. The expression (homelen - 1) is…
-
High 7.5
COVESA Open1722 0.9.2 Stack Memory Disclosure via acf-can-listener.c Integer Truncation
COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a…
-
Low 2.0
Capstone WASM `br_table` instruction-size truncation can cause no-progress disassembly and parser desynchronization
Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public `cs_disasm()` and `cs_disasm_iter()` APIs. For a large but well-formed `br_table` inst…
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Numeric truncation error in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
Medium 6.7
Windows DNS Elevation of Privilege Vulnerability
Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.
-
Medium 6.7
Windows DNS Elevation of Privilege Vulnerability
Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.
-
Medium 6.7
Windows DNS Elevation of Privilege Vulnerability
Relative path traversal in Windows DNS allows an authorized attacker to elevate privileges locally.
-
High 7.8
Microsoft Office Word Remote Code Execution Vulnerability
Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code locally.
-
Medium 6.7
Windows DNS Elevation of Privilege Vulnerability
Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.
-
Medium 6.7
Windows DNS Elevation of Privilege Vulnerability
Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.
-
Medium 6.7
Windows DNS Elevation of Privilege Vulnerability
Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.
-
High 7.8
Microsoft Digest Authentication Elevation of Privilege Vulnerability
Numeric truncation error in Microsoft Digest Authentication allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows HTTP.sys Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Network File System Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Network File System allows an authorized attacker to elevate privileges locally.
-
Medium 5.5
Microsoft Word Information Disclosure Vulnerability
Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
-
High 7.8
Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability
Numeric truncation error in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.
-
High 7.8
Windows Kernel Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Numeric truncation error in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.
-
High 8.8
DTLS 1.3 ACK serialization heap buffer overflow via integer truncation
A heap buffer overflow could occur in the DTLS 1.3 ACK serialization path before the connecting peer is authenticated. The buffer overflow was due to an integer truncation when computing the length of the ACK record-number list, causing an undersized buffer t…
-
Medium 5.4
Heap buffer overflow in DXF polyline import
LibreOffice can import drawings in the DXF format used by CAD software. A heap buffer overflow existed when importing a DXF polyline. The point count taken from the file was truncated to a 16-bit value when the point buffer was sized, while the full count was…
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Numeric truncation error in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
High 7.8
Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
Numeric truncation error in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
-
High 8.7
Heap overflow with multiple NSID, COOKIE, PADDING EDNS options
NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet. The relevant options ('nsid', 'answer-cookie', '…
-
Medium 6.2
Windows Volume Manager Extension Driver Remote Code Execution Vulnerability
Heap-based buffer overflow in Volume Manager Extension Driver allows an authorized attacker to execute code with a physical attack.
-
Low 2.9
In uriparser before 1.0.2, there is pointer difference truncation to int in various places.
-
Medium 5.1
uriparser before 1.0.1 has numeric truncation in text range comparison, if an application accepts URIs with a length in…
-
Medium 6.3
Cap'n Proto: Integer overflow in KJ-HTTP chunk size
Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, when using Transfer-Encoding: chunked, if a chunk's size parsed to a value of 2^64 or larger, it would be truncated to a 64-bit integer. In theory, this bug could enable…
-
Medium 6.3
Eclipse Paho Go MQTT may incorrectly encode strings if length exceeds 65535 bytes
In Eclipse Paho Go MQTT v3.1 library (paho.mqtt.golang) versions <=1.5.0 UTF-8 encoded strings, passed into the library, may be incorrectly encoded if their length exceeds 65535 bytes. This may lead to unexpected content in packets sent to the server (for exa…
-
High 7.8
Windows Hyper-V Elevation of Privilege Vulnerability
Numeric truncation error in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
-
High 7.2
Integer Truncation on SQLite
There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.