Weakness (CWE)
CWE-680: Integer Overflow to Buffer Overflow
The product performs a calculation to determine how much memory to allocate, but an integer overflow can occur that causes less memory to be allocated than expected, leading to a buffer overflow.
Source: MITRE CWE-680
83 results · Clear filters · Feed
-
High 7.0
Module object allocation size overflow corrupts the manager object pool
A ThreadX module chooses `object_size` when it calls `txm_module_object_allocate`. The Module Manager adds its own 16-byte private header to that size and asked the object pool for the result **without checking the addition**. A size near the top of a `ULONG`…
-
High 7.1
GUIX binary resource loader: unvalidated glyph range causes an integer underflow and a heap out-of-bounds write when loading an untrusted font or theme
The GUIX binary resource loader never checks that a font page's glyph range is well formed. `gx_page_header_first_glyph` and `gx_page_header_last_glyph` are read verbatim from the file and only the upper bound of `last_glyph` is validated, so a page declaring…
-
High 8.4
RestrictedPython: Sandbox escape via string.Formatter field resolution
RestrictedPython is a tool that helps define a subset of the Python language for accepting program input in a trusted environment. Prior to 8.4, RestrictedPython could allow a sandbox escape when a custom import policy or globals exposed the standard library …
-
High 7.8
MKVToolNix through 101.0 Heap Buffer Overflow via avilib ODML Superindex Integer Wraparound
MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib library's ODML superindex parser due to integer wraparound in 32-bit arithmetic. Attackers can craft a malicious AVI file with oversized entry counts that cause an undersized heap …
-
High 7.8
llama.cpp b1283–b9058 Integer Overflow in llama_batch_init() Function
llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llama_batch_init() function where unchecked multiplications in malloc() calls can wrap past INT32_MAX when computing allocation sizes. Attackers can pass specially crafted p…
-
High 8.1CVE-2026-55200 Public exploit
libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c
libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length value…
-
High 7.3
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of th…
-
High 8.8
A memory corruption vulnerability exists in the BMPv3 Palette Decoding functionality of the SAIL Image Decoding Library…
-
High 8.8
A memory corruption vulnerability exists in the BMPv3 Image Decoding functionality of the SAIL Image Decoding Library v…
-
High 8.8
A memory corruption vulnerability exists in the PSD Image Decoding functionality of the SAIL Image Decoding Library v0.…
-
High 8.8
A memory corruption vulnerability exists in the BMPv3 RLE Decoding functionality of the SAIL Image Decoding Library v0.…
-
High 8.8
A memory corruption vulnerability exists in the WebP Image Decoding functionality of the SAIL Image Decoding Library v0…
-
High 8.6
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Buffer Overflow Denial of Service Vulnerability
A vulnerability in the web services interface of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a buffer overflow on an affected…
-
High 7.5
NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause an integer …
-
High 8.9
Integer Overflow in GGUF Parser can lead to Heap Out-of-Bounds Read/Write in gguf
llama.cpp is an inference of several LLM models in C/C++. Integer Overflow in the gguf_init_from_file_impl function in ggml/src/gguf.cpp can lead to Heap Out-of-Bounds Read/Write. This vulnerability is fixed in commit 26a48ad699d50b6268900062661bd22f3e792579.
-
High 7.0CVE-2025-32023 Public exploit
Redis allows out of bounds writes in hyperloglog commands leading to RCE
Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially…
-
High 8.4
A memory corruption vulnerability exists in the Shared String Table Record Parser implementation in xls2csv utility ver…
-
High 7.8
Integer Overflow to Buffer Overflow in Automotive Vehicle Networks
Memory corruption while transmitting packet mapping information with invalid header payload size.
-
High 7.5
Buffer overflow vulnerability in the codec module Impact: Successful exploitation of this vulnerability may affect avai…
-
High 7.3
Integer overflow vulnerability during glTF model loading in the 3D engine module Impact: Successful exploitation of thi…
-
High 7.8
Integer Overflow to Buffer Overflow in Audio
Memory corruption while processing voice packet with arbitrary data received from ADSP.
-
High 8.2
Buffer overflow in deserialization in oqs-provider
oqs-provider is a provider for the OpenSSL 3 cryptography library that adds support for post-quantum cryptography in TLS, X.509, and S/MIME using post-quantum algorithms from liboqs. Flaws have been identified in the way oqs-provider handles lengths decoded w…
-
High 8.4
Integer Overflow to Buffer Overflow in Graphics Windows
Memory corruption while allocating memory for graphics.
-
High 7.5
Integer Overflow to Buffer Overflow in Automotive Telematics
Transient DOS while decoding the ToBeSignedMessage in Automotive Telematics.
-
High 8.4
`AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding()` and `AppendEncodedCharacters()` could have experienc…
-
High 7.5
An issue in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the packet-bgp.c, dissect_…
-
High 7.0
Integer Overflow in CreateHob
EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, a…
-
High 8.4
Integer Overflow to Buffer Overflow in HLOS
Memory corruption in HLOS while invoking IOCTL calls from user-space.
-
High 7.8
Integer Overflow to Buffer Overflow in User Identity Module
Memory corruption while using the UIM diag command to get the operators name.
-
High 8.2
Integer Overflow to Buffer Overflow in TZ Secure OS
Memory corruption while loading an ELF segment in TEE Kernel.
-
High 8.2
HCL BigFix Platform is vulnerable to an integer overflow in xerces-c++ 3.2.3
An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request.
-
High 7.0
Heap overflow issue with the Lua cjson library used by Redis
Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions…
-
High 8.4
Integer overflow to buffer overflow in Automotive Multimedia
Memory corruption in Automotive Multimedia due to integer overflow to buffer overflow during IOCTL calls in video playback.
-
High 8.4
Integer overflow to buffer overflow in WLAN
Memory corruption in WLAN due to integer overflow to buffer overflow in WLAN during initialization phase.
-
High 7.8
Integer Overflow to Buffer Overflow in Modem
Memory corruption in modem due to integer overflow to buffer overflow while handling APDU response
-
High 7.8
Integer overflow to buffer overflow in User Identity Module
Memory corruption in User Identity Module due to integer overflow to buffer overflow when a segement is received via qmi http.
-
High 7.3
An integer overflow vulnerability exists in the way ESTsoft Alyac 2.5.8.544 parses OLE files. A specially-crafted OLE f…
-
High 7.3
An integer overflow vulnerability exists in the way ESTsoft Alyac 2.5.8.544 parses OLE files. A specially-crafted OLE f…
-
High 8.8
An exploitable code execution vulnerability exists in the file format parsing functionality of Graphisoft BIMx Desktop …
-
High 7.5
Integer Underflow in Zephyr in IEEE 802154 Fragment Reassembly Header Removal
Integer Underflow in Zephyr in IEEE 802154 Fragment Reassembly Header Removal. Zephyr versions >= >=2.4.0 contain Integer Overflow to Buffer Overflow (CWE-680). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-w4…