CWE-190: Integer Overflow or Wraparound
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
Also known as Overflow, Wraparound, wrap, wrap-around, wrap around.
A kind of CWE-682 Incorrect Calculation.
From the CWE List. © The MITRE Corporation.
Newest
- trustedfirmware op-tee, op-tee optee os +1 moreOP-TEE has AES-GCM 32-bit integer overflow in length counters that breaks authentication guarantee3.8 Low
- radare radare2radareorg radare2 pb Print cmd_print.inc cmd_print integer overflow4.8 Medium
- radare radare2radareorg radare2 str.c r_str_word_get0set integer overflow4.8 Medium
- radare radare2radareorg radare2 str.c r_str_append integer overflow4.8 Medium
- radare radare2radareorg radare2 hexpairs cmd_anal.inc.c cmd_anal_opcode integer overflow4.8 Medium
- radare radare2radareorg radare2 cmd_anal.inc core_anal_bytes integer overflow4.8 Medium
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Remote Code Execution Vulnerability8.8 High
- dell powerprotect data domain, data domain operating system +1 moreDell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0...6.5 Medium
- hp hplip, red hat enterprise linux 10, enterprise linux 6 +3 more +5 moreHplip: incomplete fix for cve-2026-86319.8 Critical
jxl-oxidecrates.iojxl-oxide: `FrameBuffer::new` creates out-of-bounds slices on overflow6.2 Mediumjxl-modularcrates.iojxl-oxide: integer subtraction overflow panic in cluster_from_table via crafted JXL input (DoS)6.2 Medium- google chromeInteger overflow in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to...8.8 High
- google chromeInteger overflow in ANGLE in Google Chrome on Windows prior to 150.0.7871.46 allowed a remote...5.3 Medium
- imagemagickImageMagick: Heap Buffer Over-Read in XCF decoder due to integer conversion overflow6.5 Medium
- chan fatfsFatFs Integer Overflow in FAT32 Volume Mount7.6 High
- linux, linux kernel +1 moredrm/amd/display: Use krealloc_array() in dal_vector_reserve()7.0 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreRpm: heap buffer overflow in ndb slot table parsing5.5 Medium
- uvnc ultravncUltraVNC viewer heap buffer overflow via integer overflow in RFB connection-failure reason length8.7 High
- uvnc ultravncUltraVNC repeater integer overflow in win_log malloc leading to heap overflow5.3 Medium
- google chromeInteger overflow in Safe Browsing in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote...8.1 High
- google chromeInteger overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker...9.6 Critical
- fzfInteger Overflow in fzf5.6 Medium
- spice-space spice-vdagent, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreSpice-vdagent: integer overflow in udscs_write() leading to heap buffer overflow5.1 Medium
- libssh2libssh2 - Integer Overflow in publickey Subsystem Attribute Allocation8.3 High
- strukturag libde265libde265: SAO sequential filter heap buffer overflow via signed integer overflow7.4 High
- strukturag libde265libde265: Pixel accessor signed integer overflow causes heap OOB read/write7.4 High
- freebsdInteger overflow in vt(4) CONS_HISTORY ioctl7.8 High
- freebsdMultiple vulnerabilities in the sound(4) mmap path7.8 High
- wolfsslDTLS 1.3 ACK serialization heap buffer overflow via integer truncation8.8 High
- jqlang jqjq: potential integer overflow in jvp_string_append6.9 Medium
- linux, linux kernel, red hat enterprise linux 10 +4 more +6 moreaccel/ivpu: Fix signed integer truncation in IPC receive7.8 High
- linux, linux kernel +1 morewifi: nl80211: reject oversized EMA RNR lists7.8 High
- linux, linux kernel +1 moreRDMA/umem: Fix truncation for block sizes >= 4G7.8 High
- apache software foundation kvrocksApache Kvrocks: RESTORE IntSet Integer Overflow Leads to Remote DoS6.4 Medium
- nlnet labs nsdHeap overflow and crash with crafted SVCB RR8.7 High
- linux, linux kernel +1 mores390/bpf: Zero-extend bpf prog return values and kfunc arguments7.8 High
- linux, linux kernel +1 moredrm/komeda: fix integer overflow in AFBC framebuffer size check7.1 High
- linux, linux kernel, red hat enterprise linux 10 +13 more +15 moredm log: fix out-of-bounds write due to region_count overflow7.8 High
- linux, linux kernel +1 morescsi: target: core: Fix integer overflow in UNMAP bounds check5.5 Medium
- linux, linux kernel, red hat enterprise linux 10 +4 more +6 morecrypto: af_alg - Cap AEAD AD length to 0x800000005.5 Medium
- linux, linux kernel, red hat enterprise linux 10 +4 more +6 moreKVM: Reject wrapped offset in kvm_reset_dirty_gfn()7.8 High
- linux, linux kernel +1 moresmb/client: fix possible infinite loop and oob read in symlink_data()8.1 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morei2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moreio_uring/poll: fix signed comparison in io_poll_get_ownership()7.8 High
- linux, linux kernel +1 morebatman-adv: fix fragment reassembly length accounting9.8 Critical
- messagepack, messagepack-csharp +1 moreMessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows8.2 High
- libexpat project libexpat, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morexmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.6.9 Medium
- libexpat project libexpat, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morexmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.6.9 Medium
- libexpat project libexpat, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morexmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir...6.5 Medium
- libexpat project libexpat, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morelibexpat before 2.8.2 has an integer overflow in copyString.6.9 Medium
- Show moreLoading…