CWE-190: Integer Overflow or Wraparound
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
Also known as Overflow, Wraparound, wrap, wrap-around, wrap around.
A kind of CWE-682 Incorrect Calculation.
From the CWE List. © The MITRE Corporation.
Newest
- apple ipados, macos, ios and ipados +1 more +3 moreAn integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6...8.8 High
- apple ipados, macos, tvos +4 more +6 moreAn integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6...9.8 Critical
- apple ipados, macos, watchos +2 more +4 moreAn integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6...8.6 High
- apple ipados, macos, tvos +4 more +6 moreAn integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6...7.8 High
- apple macosAn integer overflow was addressed with improved input validation. This issue is fixed in macOS...9.8 Critical
- apple macosAn integer overflow was addressed with improved input validation. This issue is fixed in macOS...9.8 Critical
- apple ipados, macos, tvos +3 more +5 moreAn integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6...9.8 Critical
- apple ipados, macos, tvos +4 more +6 moreAn integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6...7.8 High
- linux, linux kernel +1 morebpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()8.4 High
- gimp, red hat enterprise linux 6, enterprise linux 7 +3 more +5 moreGimp: signed integer overflow in file-sgi (sgi-lib) causes the plugin to crash on rle sgi images5.5 Medium
- gimp, red hat enterprise linux 6, enterprise linux 7 +6 more +8 moreGimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted fits images7.8 High
- klauspost compressInteger Overflow or Wraparound and Out-of-bounds Write in compress7.5 High
- apache thriftApache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: integer overflow in TProtocol::checkReadBytesAvailable()8.7 High
- cjson project cjsonInteger Overflow Leading to Heap Buffer Overflow in cJSON5.1 Medium
- linux, linux kernel +1 morenet: openvswitch: reject oversized nested action attrs7.8 High
- linux, linux kernel +1 morenet/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA8.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenet: ipv4: bound TCP reordering sysctl writes and MTU probe sizes7.1 High
- linux, linux kernel +1 morebpf: Validate BTF repeated field counts before expansion7.8 High
- linux, linux kernel +1 morecrypto: ecc - Fix carry overflow in vli multiplication8.8 High
- linux, linux kernel +1 moreKVM: guest_memfd: Treat memslot binding offset+size as unsigned values7.0 High
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - Integer overflow in _PMRLogicalOffsetToPhysicalOffset9.8 Critical
- fatedier frpfrp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow8.7 High
- ffmpegFFmpeg MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File8.7 High
- imagemagickImageMagick: Integer Overflow in JNX decoder causes heap buffer over-write when processing extremly large files on 32-bit builds5.1 Medium
- libeventLibevent: `evtag_unmarshal_header()` decodes a wire `uint32` length into a signed `int` return value.8.7 High
- fluidsynthFluidSynth: DLS ptbl Chunk Integer Overflow6.8 Medium
- fluidsynthFluidSynth: DLS Articulation Chunk Integer Overflow6.8 Medium
- imagemagickImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is provided4.7 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 morelibmongocrypt Improper Input Validation Leading to Process Termination5.3 Medium
- gnu diffutilsHeap-based Buffer Overflow in GNU diffutils2.1 Low
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +5 more +7 moreLibarchive: libarchive: signed integer overflow in archive_write_zip_header2.9 Low
- google chromeInteger overflow in Chromecast in Google Chrome prior to 150.0.7871.182 allowed a local attacker...9.3 Critical
- mozilla firefox, thunderbird +1 moreInteger overflow in the Audio/Video: Playback component9.8 Critical
- mozilla firefox, thunderbird +1 moreInteger overflow in the Graphics: ImageLib component9.8 Critical
- mozilla firefox, thunderbird +1 moreInteger overflow in the Audio/Video component9.8 Critical
- mozilla firefox, thunderbird +1 moreIncorrect boundary conditions, integer overflow in the Libraries component in NSS9.8 Critical
- mozilla firefox, thunderbird +1 moreInteger overflow in the JavaScript: WebAssembly component9.8 Critical
- neutrinolabs xrdpxrdp: lib_framebuffer_update Has Integer Overflow Heap Info Leak & ASLR Bypass8.2 High
- libvipsPossible integer overflow on 32-bit systems when reading GIF images6.8 Medium
- libvipsPossible integer overflow leading to potential heap-based buffer overflow7.0 High
- proftpdProFTPD mod_sftp Signed Integer Overflow via SCP Size-Record Parser7.1 High
- linux, linux kernel +1 moreRDMA/siw: Reject MPA FPDU length underflow before signed receive math9.8 Critical
- linux, linux kernel +1 moreipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()9.8 Critical
- linux, linux kernel +1 moreKVM: SEV: Ignore Port I/O requests of length '0'9.3 Critical
- linux, linux kernel +1 morebpf: sockmap: fix tail fragment offset in bpf_msg_push_data8.4 High
- linux, linux kernel +1 moremacsec: fix replay protection at XPN lower-PN wrap8.1 High
- linux, linux kernel +1 moreusb: gadget: composite: fix integer underflow in WebUSB GET_URL handling5.5 Medium
- linux, linux kernel +1 morethunderbolt: property: Reject u32 wrap in tb_property_entry_valid()8.1 High
- linux, linux kernel +1 morescsi: scsi_transport_fc: Widen FPIN pname walker counter to u328.1 High
- linux, linux kernel +1 moredrm/amdkfd: fix a vulnerability of integer overflow in kfd debugger7.8 High
- Show moreLoading…