cve.bz

CWE-190: Integer Overflow or Wraparound (Year 2038 problem, Y2K38, Y2038, Epochalypse), page 2

Filter

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

What the weakness is: CWE-190 at MITRE

Ask an AI about CWE-190

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-190: Integer Overflow or Wraparound and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/190.html and https://cve.bz/cve/cwe/190?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2026-113399EPSS 0.5%

    Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.

  2. 6.9CVE-2026-43843EPSS 0.3%

    An integer overflow vulnerability in the license manager service could allow an unauthenticated attacker to crash the service.

  3. 4.3CVE-2026-101201EPSS 0.2%

    A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can cause undefined behaviour because of out-of-bounds read.

  4. 5.9CVE-2026-86871EPSS 0.5%

    An integer underflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker with control of a network file server may be able to cause unexpected system …

  5. 7.1CVE-2026-112158EPSS 0.3%

    A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8. Impacted is the function same_check of the file ipt_SAME.ko. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. Upgradin…

  6. 2.1CVE-2026-112074EPSS 0.2%

    A security flaw has been discovered in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this issue is the function ncnn::yuv420sp2rgb of the file src/mat_pixel.cpp of the component Conversion API. The manipulation r…

  7. 6.9CVE-2026-112052EPSS 0.2%

    libspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex count size guard of ParseWkbLine and related parsers in gg_wkb.c, allowing out-of-bounds reads. Attackers can supply a crafted geometry BLOB…

  8. 5.8CVE-2026-112011EPSS 0.1%

    libtta through 2.3 contains an integer overflow vulnerability in tta_decoder_init_get_info() that allows attackers to cause a heap buffer overflow on 32-bit builds via unvalidated header fields. Attackers can supply a crafted .tta file wit…

  9. 7.0CVE-2026-62439EPSS 0.2%

    A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker can …

  10. 6.1CVE-2026-62438EPSS 0.1%

    A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive (PAA) texture file. Due to an integ…

  11. 7.5CVE-2026-102834EPSS 0.5%

    JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries. Prior to 1.5.14, IPCameraFrameGrabber doubles a 32-bit buffer capacity without checking for overflow or bounding the parsed Content-Length. An application c…

  12. 7.5CVE-2025-66969EPSS 0.3%

    Integer overflow in OpenModSim (<=1.11.0), leading to denial of service

  13. 9.1CVE-2026-102692EPSS 0.4%

    RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, nanocoap accepts oversized CoAP Block2 option values without enforcing the 20-bit maximum block n…

  14. 7.1CVE-2026-57488EPSS 0.3%

    pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, raw_to_int in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before the ca…

  15. 7.5CVE-2026-105959EPSS 0.5%

    A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a mas…

  16. 8.7CVE-2026-111380EPSS 0.3%

    FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the audio queue buffer size as FramesPerPacket * 2 * nChannels in UINT32 arithmetic, bypassing the CVE-202…

  17. 8.8CVE-2026-111282EPSS 0.6%

    Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle_0x38_RequestFileTransfer that lets unauthenticated attackers bypass the file path length check. Attackers can send a short RequestFileTransfer (SID 0x38) request w…

  18. 6.5CVE-2026-92160EPSS 0.3%

    F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because the wrapping sum bypasses fil…

  19. 7.2CVE-2026-92158EPSS 0.9%

    F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FpySequencer STORE directive stack write validation the bounds check adds attacker-controlled…

  20. 6.5CVE-2026-92157EPSS 0.6%

    F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because unchecked startOffset plus le…

  21. 8.1CVE-2026-92154EPSS 0.6%

    F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FileUplink handleDataPacket offset and size validation is vulnerable because the component ch…

  22. 5.9CVE-2026-107348EPSS 0.4%

    Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service when max_packet_size is configured above 2147483648. A packet header declaring a …

  23. 7.1CVE-2026-101972EPSS 0.3%

    An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via specific OSPFv2 packets sen…

  24. 8.7CVE-2026-102036EPSS 0.5%

    An Integer Overflow or Wraparound vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows a configured EVPN BGP peer to cause a denial of service via EVPN Type-2 MAC/IP routes.

  25. 8.7CVE-2026-102024EPSS 0.5%

    An Integer Overflow or Wraparound vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated BGP peer to cause a denial of service via BGP route updates when extended-nexthop-tunnel …

  26. 8.7CVE-2026-101945EPSS 0.5%

    An Integer Overflow or Wraparound vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a remote attacker with an established EVPN BGP peering relationship to cause a denial of service via EVPN BGP route…

  27. 8.7CVE-2026-101944EPSS 0.5%

    An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause a denial of service via specially crafted EVPN route updates from an accepte…

  28. 8.0CVE-2026-53615EPSS 0.2%

    util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area…

  29. 2.9CVE-2026-49206EPSS 0.2%

    rapidcsv is a C++ CSV parser library. Prior to 8.99, RemoveColumn, InsertColumn, RemoveRow, InsertRow, and GetColumnNames converted size_t indexes to int before adding them to std::vector iterators. On 64-bit systems, in a CSV matrix dimen…

  30. 7.5CVE-2026-110449EPSS 0.2%

    Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled.

  31. 7.5CVE-2026-100136EPSS 0.6%

    CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-ser…

  32. 7.8CVE-2026-95636EPSS 0.2%

    Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must o…

  33. 7.0CVE-2026-88088EPSS 0.2%

    Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges locally.

  34. 7.8CVE-2026-83661EPSS 0.2%

    Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must o…

  35. 4.3CVE-2026-14532EPSS 0.2%

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a Reader-role attacker to obtain version information that causes an uncaught exception.

  36. 8.8CVE-2026-97778EPSS 0.6%

    Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

  37. 8.8CVE-2026-97753EPSS 0.8%

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

  38. 8.8CVE-2026-96943EPSS 0.6%

    Integer overflow or wraparound in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.

  39. 7.8CVE-2026-96915EPSS 0.3%

    Integer overflow or wraparound in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.

  40. 8.8CVE-2026-96914EPSS 0.3%

    Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.

  41. 7.8CVE-2026-96217EPSS 0.3%

    Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.

  42. 7.8CVE-2026-96118EPSS 0.4%

    Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

  43. 8.8CVE-2026-88186EPSS 0.9%

    Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

  44. 8.8CVE-2026-88166EPSS 0.9%

    Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  45. 8.8CVE-2026-88163EPSS 0.9%

    Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  46. 8.8CVE-2026-88145EPSS 0.7%

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

  47. 7.8CVE-2026-88118EPSS 0.4%

    Integer overflow or wraparound in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.

  48. 7.8CVE-2026-88074EPSS 0.3%

    Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.

  49. 7.8CVE-2026-87702EPSS 0.4%

    Integer overflow or wraparound in Windows Resource Management (MRM) allows an authorized attacker to elevate privileges locally.

  50. 7.8CVE-2026-85908EPSS 0.4%

    Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.