Weakness (CWE)
CWE-681: Incorrect Conversion between Numeric Types
When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
How to prevent it (1 mitigation)
-
Implementation
Avoid making conversion between numeric types. Always check for the allowed ranges.
Source: MITRE CWE-681
50 results · Clear filters · Feed
-
High 8.8
Microsoft Office Outlook Remote Code Execution Vulnerability
Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
-
High 7.8
Windows Installer Elevation of Privilege Vulnerability
Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
-
High 7.8
In the Samsung Exynos H-Arx DRM plugin, improper input validation during buffer operations can cause memory corruption,…
-
High 7.8
Windows TCP/IP Local Elevation of Privilege Vulnerability
Incorrect conversion between numeric types in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
-
High 7.8
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could c…
-
High 7.5
MuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsR_isindex() in jsrun.c. A specially crafted …
-
High 7.5
NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in the rasterizer's nsvg__addActive() f…
-
High 7.5
NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__pathArcTo() when parsing SVG a…
-
High 8.9
RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readField in read.go reads the length of an AMQP byte-array field with type tag x into a signed int32 and passes the value directly to make when allocating the field buffer. A malicious or compro…
-
High 8.1
Microsoft JScript Remote Code Execution Vulnerability
Incorrect conversion between numeric types in Microsoft JScript allows an unauthorized attacker to execute code over a network.
-
High 7.8
su-exec through 0.3 Privilege Escalation via Numeric User ID
su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uid_t and gid_t, allowing truncation of out-of-range values to zero. Attackers can supply large numeric identifiers that truncate to root's identif…
-
High 8.7
GoAccess WebSocket Server: Signed 32 bit truncation of the 64 bit frame length causes a remote pre-authentication denial of service
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to version 1.11, the built-in WebSocket server narrows a 64-bit extended frame length into the signed 32-bit WSFrame.payloadl…
-
High 7.8
Microsoft PowerPoint Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
-
High 7.8CVE-2026-50402 Public exploit
NTFS Elevation of Privilege Vulnerability
Incorrect conversion between numeric types in Windows NTFS allows an authorized attacker to elevate privileges locally.
-
High 7.8CVE-2026-45258 Public exploit
Multiple vulnerabilities in the sound(4) mmap path
dsp_mmap_single() validated the requested mapping by checking the sum of the user-supplied offset and length against the buffer size. This addition could overflow, so that a large offset and length wrapped around and passed the check. The offset was then narr…
-
High 8.8
iommu/amd: Fix clone_alias() to use the original device's devid
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix clone_alias() to use the original device's devid Currently clone_alias() assumes first argument (pdev) is always the original device pointer. This function is called by pci_for…
-
High 8.7
iskorotkov/avro: Integer Overflow in Avro Decoder
iskorotkov/avro is a fast Go Avro codec. Prior to 2.33.0, several Avro decoder paths read attacker-controlled 64-bit values from the wire format and either narrowed them to platform-sized int before bounds-checking, or summed them with overflow-prone signed-i…
-
High 7.8
NVIDIA Display Driver for Linux contains a vulnerability where an attacker could cause an incorrect conversion between …
-
High 8.8
Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability
Integer size truncation in Windows Advanced Rasterization Platform (WARP) allows an unauthorized attacker to elevate privileges locally.
-
High 7.5
NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malfo…
-
High 7.5
jsrsasign: Negative Exponent Handling Leads to Signature Verification Bypass
Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js. An attacker can force the computation of incorrect modular inverses and break signature verificati…
-
High 7.5
ImageMagick has integer overflow or wraparound and incorrect conversion between numeric types in the internal SVG decoder
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file can cause a denial of service. An off-by-one boundary check (`>` instead of `>=`) that allows bypass th…
-
High 7.8
iccDEV has UB runtime error in <icTagTypeSignature>
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Versions prior to 2.3.1.2 have an undefined behavior issue when floating-point NaN values are converted to unsigned sh…
-
High 8.8
iccDEV has Type Confusion in CIccSegmentedCurveXml::ToXml() at IccXML/IccLibXML/IccMpeXml.cpp
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `CIccSegmentedCurveX…
-
High 8.8
iccDEV has Type Confusion in SIccCalcOp::ArgsPushed() at IccProfLib/IccMpeCalc.cpp
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `SIccCalcOp::ArgsPus…
-
High 7.8
iccDEV has Integer Overflow/Underflow in CIccXmlArrayType::ParseTextCountNum()
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below have overflows and underflows in CIccXmlArrayType::ParseTextCountNum(). This vulnerability affects users of the iccDEV library who process IC…
-
High 7.1
CoreDNS: DNS Cache Pinning via etcd Lease ID Confusion
CoreDNS is a DNS server that chains plugins. Starting in version 1.2.0 and prior to version 1.12.4, the CoreDNS etcd plugin contains a TTL confusion vulnerability where lease IDs are incorrectly used as TTL values, enabling DNS cache pinning attacks. This eff…
-
High 8.4
Microsoft Word Remote Code Execution Vulnerability
Incorrect conversion between numeric types in Microsoft Office Word allows an unauthorized attacker to execute code locally.
-
High 7.8
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Incorrect conversion between numeric types in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
-
High 8.8
Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability
Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability
-
High 8.8
Microsoft ODBC Driver Remote Code Execution Vulnerability
Microsoft ODBC Driver Remote Code Execution Vulnerability
-
High 7.5
Incorrect code generation could have led to unexpected numeric conversions and potential undefined behavior.*Note:* Thi…
-
High 8.6CVE-2023-46848 EPSS 11%
Squid: denial of service in ftp
Squid is vulnerable to Denial of Service, where a remote attacker can perform DoS by sending ftp:// URLs in HTTP Request messages or constructing ftp:// URLs from FTP Native input.
-
High 8.6
A vulnerability in the hardware-based SSL/TLS cryptography functionality of Cisco Adaptive Security Appliance (ASA) Sof…
-
High 7.8
NTFS Elevation of Privilege Vulnerability
NTFS Elevation of Privilege Vulnerability
-
High 8.8
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
-
High 7.8
Windows Media Remote Code Execution Vulnerability
Windows Media Remote Code Execution Vulnerability
-
High 8.8CVE-2023-23388 Public exploit
Windows Bluetooth Driver Elevation of Privilege Vulnerability
Windows Bluetooth Driver Elevation of Privilege Vulnerability
-
High 7.8
Microsoft Office Visio Remote Code Execution Vulnerability
Microsoft Office Visio Remote Code Execution Vulnerability
-
High 7.5
Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are re…