cve.bz

CWE-190: Integer Overflow or Wraparound (Year 2038 problem, Y2K38, Y2038, Epochalypse), page 3

Filter

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

What the weakness is: CWE-190 at MITRE

Ask an AI about CWE-190

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-190: Integer Overflow or Wraparound and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/190.html and https://cve.bz/cve/cwe/190?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2026-85820EPSS 0.3%

    Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.

  2. 7.8CVE-2026-85807EPSS 0.3%

    Integer overflow or wraparound in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.

  3. 8.8CVE-2026-85363EPSS 0.9%

    Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.

  4. 7.8CVE-2026-83918EPSS 0.3%

    Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges locally.

  5. 7.8CVE-2026-83877EPSS 0.4%

    Integer overflow or wraparound in HID Parser Library allows an authorized attacker to elevate privileges locally.

  6. 7.8CVE-2026-83847EPSS 0.3%

    Heap-based buffer overflow in Microsoft Account allows an authorized attacker to elevate privileges locally.

  7. 7.8CVE-2026-83828EPSS 0.4%

    Heap-based buffer overflow in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.

  8. 8.8CVE-2026-83725EPSS 0.8%

    Heap-based buffer overflow in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.

  9. 8.8CVE-2026-83688EPSS 0.9%

    Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

  10. 9.8CVE-2026-83578EPSS 1.1%

    Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthorized attacker to execute code over a network.

  11. 6.8CVE-2026-83573EPSS 0.5%

    Integer overflow or wraparound in Windows Kernel Mode Driver allows an unauthorized attacker to elevate privileges with a physical attack.

  12. 8.1CVE-2026-70269EPSS 0.8%

    Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

  13. 8.8CVE-2026-70258EPSS 0.9%

    Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.

  14. 8.8CVE-2026-70257EPSS 0.9%

    Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

  15. 8.8CVE-2026-70149EPSS 0.9%

    Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to disclose information locally.

  16. 7.8CVE-2026-70113EPSS 0.4%

    Integer overflow or wraparound in Windows Client for NFS allows an authorized attacker to elevate privileges locally.

  17. 7.8CVE-2026-70052EPSS 0.4%

    Integer overflow or wraparound in Windows PowerShell allows an authorized attacker to execute code locally.

  18. 7.8CVE-2026-70008EPSS 0.4%

    Integer overflow or wraparound in Windows IP Over USB Service allows an authorized attacker to elevate privileges locally.

  19. 7.8CVE-2026-69966EPSS 0.3%

    Integer overflow or wraparound in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.

  20. 7.8CVE-2026-69963EPSS 0.3%

    Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.

  21. 7.8CVE-2026-69957EPSS 0.4%

    Integer overflow or wraparound in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.

  22. 7.8CVE-2026-69934EPSS 0.4%

    Integer overflow or wraparound in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.

  23. 7.8CVE-2026-69916EPSS 0.4%

    Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges locally.

  24. 8.8CVE-2026-69521EPSS 0.8%

    Integer overflow or wraparound in Windows iSCSI allows an unauthorized attacker to execute code over a network.

  25. 7.8CVE-2026-69354EPSS 0.4%

    Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

  26. 8.4CVE-2026-110247EPSS 0.2%

    Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a sub…

  27. 3.3CVE-2026-110036EPSS 0.2%

    A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service (DoS) by inducing a user or system tool to process crafted device metadata containing an excessively large block index. An arithmetic error i…

  28. 8.8CVE-2026-108400EPSS 0.9%

    Integer overflow or wraparound in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.

  29. 7.5CVE-2026-105715EPSS 0.6%

    Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

  30. 8.8CVE-2026-102856EPSS 0.9%

    Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.

  31. 6.7CVE-2026-54697EPSS 0.1%

    ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, DerReader.readLength() accepts excessive long-form DER length octets, accumulates them into an Int, and primitive readers allocate arr…

  32. 7.8CVE-2026-95121EPSS 0.2%

    An issue in mp4v2 2.0.0 allows an attacker to execute arbitrary code via the MP4RtpAtom::ReadHntiType() in src/atom_rtp.cpp. A specially crafted MP4 file can cause an undersized rtp atom to produce a near-2^64 allocation size through an un…

  33. 7.1CVE-2026-77093EPSS 0.2%

    CvFWD contained an integer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and H…

  34. 7.1CVE-2026-109938EPSS 0.3%

    Positive mapped-video coordinates overflow and abort FreeRDP clients A malicious or compromised RDP server can terminate a FreeRDP client after the user connects with video redirection enabled.

  35. 7.1CVE-2025-58771EPSS 0.1%

    AMI APTIOV contains vulnerabilities in BIOS where users may cause “Integer Overflow or Wraparound” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code executi…

  36. 8.8CVE-2026-109730EPSS 0.4%

    Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  37. 5.4CVE-2026-109723EPSS 0.2%

    Integer overflow in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  38. 10.0CVE-2026-97229KEVExploitEPSS 27%

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code …

  39. 7.1CVE-2026-35001EPSS 0.1%

    OpenS100 through commit 2b1dafc contains an integer overflow vulnerability in the S-102 Bathymetric Surface parser. An attacker can supply a crafted S-102 HDF5 file with malicious grid dimension metadata that causes memory corruption when …

  40. 5.9CVE-2026-109448EPSS 0.2%

    Integer wraparound in psqlODBC SQLBindParameter allows an application, or an attacker who controls how many parameters the application binds on one statement, to corrupt heap memory. psqlODBC stores the binding count in a signed 16-bit fie…

  41. 9.1CVE-2026-103635EPSS 0.4%

    Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). compact_theta_sketch::deserialize() and wrapped_compact_theta_sketch::wrap() read header fields before checking that the i…

  42. 5.3CVE-2026-107820EPSS 0.4%

    x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.2, src/core/mcp_server.zig parses an unbounded Content-Length value in parseContentLength() a…

  43. 8.8CVE-2026-19569EPSS 0.2%

    dynamic_object_create() in kernel/userspace/userspace.c computed the backing allocation for a dynamically allocated kernel object as obj_size_get(otype) + size, and for thread stack elements as STACK_ELEMENT_DATA_SIZE(size) (a round-up plu…

  44. 5.5CVE-2026-107730EPSS 0.1%

    SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, LitParseHeader() in src/LitDoc.cpp computes the attacker-controlled hdrLen + nPieces * 16 section offset using signed 32-bit arithmetic without validating the complete result…

  45. 8.2CVE-2026-107324EPSS 0.2%

    An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected app…

  46. 6.8CVE-2026-107446EPSS 0.4%

    containerd overlaybd through 1.0.18 has a do_load_index (LSMT index loading) integer overflow (and resultant out-of-bounds heap access) for index_bytes, if an untrusted overlaybd blob from a registry is used in a scenario with multiple ove…

  47. 6.5CVE-2026-107224EPSS 0.3%

    Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, a Zip64 uncompressed size with the high bit set is converted from uint64 to a negative int64 before signed size-limit checks and …

  48. 7.5CVE-2026-107217EPSS 0.4%

    Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0 in github.com/xuri/excelize/v2 and from 1.1.0 to 1.4.1 in github.com/xuri/excelize, ColumnNameToNumber accumulates a bijective bas…

  49. 6.5CVE-2026-106574EPSS 0.2%

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a client connected to the distributed pixel cache server can send crafted pixel data that triggers an integer-size calculatio…

  50. 5.5CVE-2026-106571EPSS 0.1%

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 6.9.13-56 and 7.1.2-31, a crafted local call to the GetVirtualPixels API can trigger an integer calculation error and write beyond a he…