cve.bz

CWE-190: Integer Overflow or Wraparound (Year 2038 problem, Y2K38, Y2038, Epochalypse), page 7

Filter

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

What the weakness is: CWE-190 at MITRE

Ask an AI about CWE-190

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-190: Integer Overflow or Wraparound and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/190.html and https://cve.bz/cve/cwe/190?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2026-69584EPSS 0.3%

    Integer overflow or wraparound in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.

  2. 8.8CVE-2026-69499EPSS 0.8%

    Integer overflow or wraparound in Windows Imaging Component allows an unauthorized attacker to execute code over a network.

  3. 6.6CVE-2026-69469EPSS 0.5%

    Integer overflow or wraparound in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to elevate privileges with a physical attack.

  4. 9.8CVE-2026-69408EPSS 1.0%

    Integer overflow or wraparound in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.

  5. 7.8CVE-2026-69407EPSS 0.3%

    Integer overflow or wraparound in Volume Manager Driver allows an authorized attacker to elevate privileges locally.

  6. 6.7CVE-2026-69373EPSS 0.3%

    Integer overflow or wraparound in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.

  7. 7.5CVE-2026-69329EPSS 1.2%

    Out-of-bounds read in BranchCache allows an unauthorized attacker to deny service over a network.

  8. 7.8CVE-2026-69298EPSS 0.3%

    Integer overflow or wraparound in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  9. 8.8CVE-2026-69266EPSS 0.8%

    Integer overflow or wraparound in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

  10. 7.1CVE-2026-68889EPSS 0.6%

    Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network.

  11. 7.8CVE-2026-68832EPSS 0.3%

    Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges locally.

  12. 6.5CVE-2026-67641EPSS 1.1%

    Integer overflow or wraparound in SQL Server allows an authorized attacker to deny service over a network.

  13. 8.8CVE-2026-67384EPSS 0.9%

    Integer overflow or wraparound in SQL Server allows an authorized attacker to execute code over a network.

  14. 7.5CVE-2026-67376EPSS 1.2%

    Integer overflow or wraparound in SQL Server allows an unauthorized attacker to deny service over a network.

  15. 7.1CVE-2026-82076EPSS 0.4%

    An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary database-level read/write privileges to bypass an internal resource limit. Submitting a specially crafted query causes the …

  16. 2.1CVE-2026-86289EPSS 0.7%

    A vulnerability was found in Ollama up to 0.31.1. This issue affects the function readGGUFV1String of the file fs/ggml/gguf.go of the component GGUF Decoder. Performing a manipulation results in integer overflow. The attack is possible to …

  17. 8.7CVE-2026-84732EPSS 0.3%

    Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via crafted inputs that trigger a timeout integer overflow

  18. 6.2CVE-2026-86314EPSS 0.2%

    Integer overflow in the source-bounds check in Memory::init() (src/runtime/Memory.cpp) in Samsung walrus on all platforms allows a remote attacker to cause an out-of-bounds heap read and denial of service via a crafted WebAssembly module i…

  19. 7.8CVE-2026-86139EPSS 0.2%

    In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.

  20. 7.8CVE-2026-86138EPSS 0.1%

    In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.

  21. 6.5CVE-2026-18078EPSS 0.5%

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to an integer overflow.

  22. 6.5CVE-2026-81666EPSS 0.2%

    An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected messag…

  23. 9.3CVE-2026-85438EPSS 1.1%

    MOOS-IvP through 24.8.1 contains a buffer overflow vulnerability in StringToIvPFunction() where dimension, piece, and degree counts from encoded BHV_IPF payloads are used as allocation sizes and loop bounds without validation. Attackers ca…

  24. 5.9CVE-2026-84965EPSS 0.1%

    An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation still writes through the stale pointer. On builds where sizes are 32 bits, a…

  25. 7.5CVE-2026-48486EPSS 0.3%

    Signum Node is a HDD-mined cryptocurrency using an energy efficient and fair Proof-of-Commitment (PoC+) consensus algorithm. Prior to version 3.9.9, an integer overflow in BlockServiceImpl.applyBlock() allowed a miner to receive an arbitra…

  26. 8.2CVE-2026-75538EPSS 0.9%

    An attacker that connects to an open Erlang TCP port that uses the inet driver with {packet,4} mode can use a signed overflow in an incorrect packet length calculation to overflow the receive buffer into the VM allocator area and beyond up…

  27. 9.2CVE-2026-9621EPSS 0.4%

    A denial-of-service security issue exists within RSLinx® Classic. The security issue stems from improper handling of a malformed packet. A crafted CIP packet can cause the RSLinx® Classic service to crash, requiring a restart of the servic…

  28. 9.8CVE-2026-84141EPSS 0.3%

    Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

  29. 5.9CVE-2026-82737EPSS 0.2%

    Integer Overflow or Wraparound vulnerability in ash-project ash lets an attacker corrupt a stored vector and crash later reads of it by submitting a vector with more than 65,535 elements. Ash.Vector.new/1 (lib/ash/vector.ex) encodes a vec…

  30. 8.5CVE-2026-82908EPSS 0.2%

    A vulnerability was found in MSI Dragon Center up to 2.0.155.0. Affected by this vulnerability is the function MmioWritePath in the library NTIOLib_X64.sys of the component MMIO Write Path Handler. Performing a manipulation of the argument…

  31. 8.7CVE-2026-55764EPSS 0.5%

    Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, Klever-Go allows a mint-role holder to bypass a finite per-nonce MaxSupply on the semi-fungible token add-quantity path. In core/kapp/systemAccount/syst…

  32. 9.6CVE-2026-54755EPSS 0.6%

    Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, split-royalty fields decoded in core/kapp/builtInFunctions/utils.go can contain values greater than core.HundredPercent, and core/kapp/kda/create.go and…

  33. 9.3CVE-2026-19313EPSS 0.7%

    An heap overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.

  34. 7.5CVE-2026-38350EPSS 0.5%

    An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

  35. 7.5CVE-2026-38349EPSS 0.5%

    An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file.

  36. 7.5CVE-2026-38348EPSS 0.5%

    An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file.

  37. 7.5CVE-2026-38346EPSS 0.5%

    An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file.

  38. 6.5CVE-2026-38343EPSS 0.4%

    An integer overflow in the libavfilter/vf_scale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file.

  39. 7.5CVE-2026-37198EPSS 0.6%

    An integer overflow in the SMF component of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted GTP packet.

  40. 7.5CVE-2026-30045EPSS 0.6%

    An integer overflow in the /nnrf-disc/v1/nf-instances component of open5gs v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted HTTP/2 GET request.

  41. 5.9CVE-2026-47857EPSS 0.4%

    In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earl…

  42. 9.8CVE-2025-70293EPSS 0.8%

    An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability exists in function ext4fs_get_bgdtable, the size calculation can lead to under allocation and this underallocated buffer will be used in memcpy() whic…

  43. 9.8CVE-2025-70290EPSS 0.7%

    An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability in the ZFS filesystem support can be triggered by malformed on-disk metadata. The issue may result in incorrect memory allocation followed by out-of-b…

  44. 5.5CVE-2026-79902EPSS 0.3%

    A flaw was found in the Seattle FilmWorks plugin in GIMP. When processing a specially crafted SFW image file, the plugin allocates a Variable-Length Array (VLA) on the stack without integer overflow checks, causing an unbounded stack alloc…

  45. 4.6CVE-2026-76149EPSS 0.1%

    CorvusSKK contains an integer overflow vulnerability, which may allow malicious data to be written to a dictionary file.

  46. 8.3CVE-2026-79292EPSS 0.4%

    Integer overflow in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security…

  47. 8.8CVE-2026-79223EPSS 0.3%

    Integer overflow in Chromium in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory inside the sandbox via a crafted file. (Chromium security severity: Low)

  48. 8.8CVE-2026-79215EPSS 0.5%

    Integer overflow in WebGL in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  49. 8.8CVE-2026-78950EPSS 0.5%

    Integer overflow in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

  50. 8.4CVE-2026-52491EPSS 0.2%

    An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the libtiff/tools/thumbnail.c: main() component