cve.bz

CWE-190: Integer Overflow or Wraparound (Year 2038 problem, Y2K38, Y2038, Epochalypse), page 11

Filter

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

What the weakness is: CWE-190 at MITRE

Ask an AI about CWE-190

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-190: Integer Overflow or Wraparound and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/190.html and https://cve.bz/cve/cwe/190?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 2.9CVE-2026-16517EPSS 0.1%

    A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archive_write_zip_header function in archive_write_set_format_zip.c, when ZIP encryption is enabled and the entry file size is close to INT64_MAX, the add…

  2. 9.3CVE-2026-16416EPSS 0.1%

    Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.182 allowed a local attacker to potentially perform a sandbox escape via malicious network traffic. (Chromium security severity: High)

  3. 6.8CVE-2026-47251EPSS 0.2%

    libheif is a HEIF and AVIF file format decoder and encoder. The fix for CVE-2026-3949 (commit `b97c8b5`, PR #1712) introduced an integer overflow in the very security check it added. The check itself can be bypassed, allowing a crafted HEI…

  4. 6.1CVE-2026-47714EPSS 0.2%

    libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, the inline mask parsing code in `libheif/region.cc` contains an integer overflow. Both `width` and `height` are `unsigned int` (32-bit) values parsed…

  5. 9.8CVE-2026-16408EPSS 0.6%

    Integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

  6. 9.8CVE-2026-16402EPSS 0.6%

    Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

  7. 9.8CVE-2026-16395EPSS 0.6%

    Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

  8. 9.8CVE-2026-16389EPSS 0.6%

    Incorrect boundary conditions, integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

  9. 9.8CVE-2026-16369EPSS 0.6%

    Integer overflow in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

  10. 9.1CVE-2026-41521EPSS 0.7%

    xrdp is an open source RDP server. Versions 0.10.6 and prior contain an integer overflow vulnerability when processing screen update messages within the vnc-any connection mode. A malicious remote VNC server can send crafted image dimensio…

  11. 6.8CVE-2026-33328EPSS 0.1%

    libvips is a fast image processing library with low memory needs. On 32-bit systems in versions before and including 8.18.0, the `gifload` operation could incorrectly determine dimensions leading to an integer overflow. This has been patch…

  12. 7.0CVE-2026-33327EPSS 0.2%

    libvips is a fast image processing library with low memory needs. The `vipsload` operation in versions before and including 8.18.0 could incorrectly determine image dimensions leading to an integer overflow and a subsequent heap-based buff…

  13. 7.1CVE-2026-63091EPSS 0.5%

    ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the mod_sftp module's SCP size-record parser that allows authenticated low-privilege attackers to bypass ASLR by sending a crafted file size value of U…

  14. 9.8CVE-2026-64102EPSS 0.5%

    In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Reject MPA FPDU length underflow before signed receive math A malicious connected siw peer can send an iWARP FPDU whose MPA length field (c_hdr->mpa_len, 16 bi…

  15. 9.8CVE-2026-63984EPSS 0.5%

    In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() ipv6_rpl_srh_decompress() computes: outhdr->hdrlen = (((n + 1) * sizeof(struct in6_addr)) >> 3); hdrlen…

  16. 9.3CVE-2026-63940EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Ignore Port I/O requests of length '0' Explicitly ignore Port I/O requests of length '0' (or count '0'), so that setting up the software scratch area (and othe…

  17. 8.4CVE-2026-63926EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data When bpf_msg_push_data() inserts data in the middle of a scatterlist entry, it splits the original entry into…

  18. 8.1CVE-2026-63925EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: macsec: fix replay protection at XPN lower-PN wrap In macsec_post_decrypt(), when pn is U32_MAX, pn + 1 overflows u32 to 0 and the first branch never fires. If next_pn_h…

  19. 8.1CVE-2026-63893EPSS 0.4%

    In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() entry->value is u32 and entry->length is u16; the sum is performed in u32 and wraps. A malicious XDo…

  20. 8.1CVE-2026-63889EPSS 0.4%

    In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 An adjacent Fibre Channel fabric actor that can deliver an FPIN ELS frame to an lpfc or qla2xxx Linux ini…

  21. 7.8CVE-2026-63881EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger get_queue_ids() computes array_size = num_queues * sizeof(uint32_t), which could overflow on 32-bit s…

  22. 7.6CVE-2026-63869EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap When parsing the radiotap header of an injected frame, ieee80211_parse_tx_radiotap() uses the…

  23. 6.5CVE-2026-55254EPSS 0.3%

    NCalc is a fast, lightweight expression evaluator for .NET. Prior to 6.1.1, the factorial operator implementation in src/NCalc.Core/Helpers/MathHelper.cs permits specially crafted expressions with extremely large factorial operands, causin…

  24. 7.5CVE-2026-59117EPSS 0.6%

    Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code over a network.

  25. 6.2CVE-2026-48354EPSS 0.3%

    CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-ser…

  26. 7.8CVE-2026-48342EPSS 0.3%

    Bridge is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malic…

  27. 9.8CVE-2026-58594EPSS 0.8%

    Integer overflow or wraparound in Windows RDP allows an unauthorized attacker to execute code over a network.

  28. 7.8CVE-2026-58532EPSS 0.3%

    Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges locally.

  29. 8.8CVE-2026-56647EPSS 0.9%

    Integer overflow or wraparound in Windows Remote Access Service Infrastructure allows an authorized attacker to elevate privileges over a network.

  30. 8.8CVE-2026-56194EPSS 0.9%

    Heap-based buffer overflow in Windows Network File System allows an authorized attacker to elevate privileges over a network.

  31. 7.8CVE-2026-56182EPSS 0.3%

    Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges locally.

  32. 5.5CVE-2026-55057EPSS 0.5%

    Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to disclose information locally.

  33. 7.8CVE-2026-55048EPSS 0.5%

    Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  34. 7.8CVE-2026-55043EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.

  35. 7.8CVE-2026-55033EPSS 0.6%

    Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute code locally.

  36. 5.5CVE-2026-55026EPSS 0.4%

    Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to disclose information locally.

  37. 7.8CVE-2026-54124EPSS 0.5%

    Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code locally.

  38. 7.8CVE-2026-54115EPSS 0.3%

    Integer overflow or wraparound in Windows Active Directory allows an authorized attacker to elevate privileges locally.

  39. 7.8CVE-2026-50435EPSS 0.3%

    Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.

  40. 7.8CVE-2026-50347EPSS 0.5%

    Heap-based buffer overflow in Windows Data dll allows an unauthorized attacker to execute code locally.

  41. 4.7CVE-2026-50310EPSS 0.3%

    Integer overflow or wraparound in Windows Devices Human Interface allows an authorized attacker to disclose information locally.

  42. 7.8CVE-2026-50306EPSS 0.3%

    Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

  43. 8.2CVE-2026-59197EPSS 0.4%

    Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2…

  44. 7.8CVE-2026-55012EPSS 0.5%

    Integer overflow or wraparound in Microsoft Defender allows an unauthorized attacker to execute code locally.

  45. 7.8CVE-2026-54109EPSS 0.3%

    Integer overflow or wraparound in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.

  46. 6.8CVE-2026-50299EPSS 0.4%

    Integer overflow or wraparound in Windows Storage Spaces Direct allows an unauthorized attacker to execute code with a physical attack.

  47. 6.8CVE-2026-50298EPSS 0.4%

    Integer overflow or wraparound in Windows Spaceport.sys allows an unauthorized attacker to elevate privileges with a physical attack.

  48. 7.8CVE-2026-49800EPSS 0.3%

    Integer overflow or wraparound in Windows Web Proxy Auto-Discovery Protocol (WPAD) allows an authorized attacker to elevate privileges locally.

  49. 6.8CVE-2026-49168EPSS 0.4%

    Integer overflow or wraparound in Windows Storage Spaces Direct allows an unauthorized attacker to elevate privileges with a physical attack.

  50. 7.5CVE-2026-59199EPSS 0.4%

    Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste(), Image.crop(), or Image.al…