cve.bz

CWE-190: Integer Overflow or Wraparound (Year 2038 problem, Y2K38, Y2038, Epochalypse), page 9

Filter

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

What the weakness is: CWE-190 at MITRE

Ask an AI about CWE-190

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-190: Integer Overflow or Wraparound and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/190.html and https://cve.bz/cve/cwe/190?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2026-68479EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: validate firmware patch bounds rtlbt_parse_firmware() copies patch_length - 4 bytes before appending the firmware version. A malformed firmware patch s…

  2. 5.3CVE-2026-18671EPSS 0.4%

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated attacker to force a NetServer server thread exception, caused by an integer overflow during bounds checking in request processing. The attacker could exploit this vulnerability to c…

  3. 5.3CVE-2026-17216EPSS 0.5%

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an integer error when processing DRDA large-object headers.

  4. 6.6CVE-2026-73645EPSS 0.5%

    OpenZeppelin Confidential Contracts is an experimental library for developing applications on the Zama fhEVM. Prior to 0.3.1, the ERC7984 contract tracked confidential total supply with an euint64 value, and an overflowing internal _mint o…

  5. 8.7CVE-2026-73564EPSS 0.5%

    frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by adding 4 to an attacker-controlled four-byte big-endian length. A length of 0xFFFFFFFF make…

  6. 6.0CVE-2026-55400EPSS 0.4%

    CVE-2026-55400 is an integer underflow in Secure Access servers prior to version 14.57. Attackers with an authenticated session can send specially crafted traffic to a server in a non-default configuration and cause a persistent denial …

  7. 5.3CVE-2026-73558EPSS 0.4%

    vLLM is an inference and serving engine for large language models. Prior to 0.27.0, an integer overflow in blockIdx.x * 2 * d in activation_kernels.cu can cause act_and_mul_kernel to consume another batched user's input, allowing a request…

  8. 7.1CVE-2026-70462EPSS 0.3%

    rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero o…

  9. 8.8CVE-2026-15742EPSS 0.6%

    Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein() or lev…

  10. 8.8CVE-2026-14677EPSS 0.4%

    Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operati…

  11. 8.8CVE-2026-14662EPSS 0.5%

    Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary co…

  12. 9.5CVE-2026-19001EPSS 0.5%

    The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, schema, or object name to a metadata retrieval function. This may result in memory corruption …

  13. 7.8CVE-2026-47940EPSS 0.3%

    Lightroom Classic is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must o…

  14. 7.4CVE-2026-73086EPSS 0.3%

    nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, al…

  15. 8.1CVE-2026-71331EPSS 0.7%

    Integer overflow or wraparound in Windows Device Health Attestation (DHA) allows an unauthorized attacker to execute code over a network.

  16. 8.8CVE-2026-70329EPSS 0.8%

    Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

  17. 7.8CVE-2026-65814EPSS 0.3%

    Heap-based buffer overflow in Windows Storage Port Driver allows an authorized attacker to elevate privileges locally.

  18. 7.8CVE-2026-65799EPSS 0.3%

    Integer overflow or wraparound in Windows DNS allows an authorized attacker to elevate privileges locally.

  19. 7.8CVE-2026-64911EPSS 0.5%

    Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally.

  20. 7.8CVE-2026-64903EPSS 0.5%

    Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally.

  21. 7.8CVE-2026-64898EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

  22. 7.8CVE-2026-63532EPSS 0.5%

    Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally.

  23. 7.0CVE-2026-62897EPSS 0.4%

    Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally.

  24. 7.8CVE-2026-62886EPSS 0.5%

    Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.

  25. 8.8CVE-2026-62822EPSS 0.8%

    Integer overflow or wraparound in Windows GDI+ allows an unauthorized attacker to execute code over a network.

  26. 8.8CVE-2026-62816EPSS 0.5%

    Heap-based buffer overflow in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent network.

  27. 7.8CVE-2026-62751EPSS 0.3%

    Integer overflow or wraparound in Windows Projected File System allows an authorized attacker to elevate privileges locally.

  28. 7.8CVE-2026-62735EPSS 0.3%

    Heap-based buffer overflow in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.

  29. 6.8CVE-2026-62699EPSS 0.4%

    Null pointer dereference in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to execute code locally.

  30. 7.8CVE-2026-61937EPSS 0.3%

    Integer overflow or wraparound in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.

  31. 7.8CVE-2026-59127EPSS 0.3%

    Integer overflow or wraparound in Windows Installer allows an authorized attacker to elevate privileges locally.

  32. 7.8CVE-2026-58641EPSS 0.5%

    Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.

  33. 6.2CVE-2026-48445EPSS 0.3%

    CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-ser…

  34. 6.2CVE-2026-48444EPSS 0.3%

    CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-ser…

  35. 6.2CVE-2026-48387EPSS 0.3%

    CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-ser…

  36. 2.4CVE-2026-28729EPSS 0.1%

    Integer overflow in the UEFI firmware for the Intel(R) Slim Bootloader may allow an information disclosure. System software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This resul…

  37. 7.1CVE-2026-73074EPSS 0.10%

    Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying …

  38. 7.5CVE-2026-15562EPSS 0.9%

    A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or :9990, or :4447) and complete an Upgrade: jboss-remoting handshake can cause OOM errors that degrade requests server-wide, leading to denia…

  39. 8.1CVE-2026-68373EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() at76_guess_freq() checks only that the received frame is at least a bare 802.11 header (24 bytes) before …

  40. 7.5CVE-2026-68315EPSS 0.5%

    In the Linux kernel, the following vulnerability has been resolved: sctp: validate stream count in sctp_process_strreset_inreq() When processing a RESET_IN_REQUEST from a peer, sctp_process_strreset_inreq() derives the stream count from …

  41. 7.8CVE-2026-68297EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: tipc: fix u16 MTU truncation in media and bearer MTU validation Both TIPC_NL_MEDIA_SET and TIPC_NL_BEARER_SET accept user-supplied MTU values but only enforce a minimum …

  42. 7.8CVE-2026-68257EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation total_cwsr_size was computed in 32-bit before being used as a BO/SVM allocation size. With large ctx_save_…

  43. 9.8CVE-2026-68158EPSS 0.7%

    In the Linux kernel, the following vulnerability has been resolved: libceph: Fix multiplication overflow in decode_new_up_state_weight() If a message of type CEPH_MSG_OSD_MAP contains a (maliciously) corrupted osdmap, out-of-bounds memor…

  44. 7.8CVE-2026-68145EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: iomap: fix out-of-bounds bitmap_set() with zero-length range ifs_set_range_dirty() and ifs_set_range_uptodate() compute last_blk as (off + len - 1) >> i_blkbits. When o…

  45. 8.8CVE-2026-68125EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: reject frames shorter than the authentication tag llsec_do_decrypt_auth() computes the associated-data length for the AEAD request as assoclen += dat…

  46. 8.8CVE-2026-68108EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: fix integer overflow in image size Fix a security vulnerability where malicious VCE command streams with oversized dimensions (e.g. 65536×65536) cause 32…

  47. 5.5CVE-2026-59088EPSS 0.3%

    A flaw was found in GIMP. A signed integer overflow vulnerability exists in the `file-fli` plugin when processing FLI image files. This occurs due to an incorrect calculation during memory allocation for image buffers, where the multiplica…

  48. 5.3CVE-2026-71393EPSS 0.7%

    GNU Emacs for Android is vulnerable to an integer overflow in sfnt_read_name_table() in src/sfnt.c. The function computes an allocation size using a 32-bit length value from a TrueType font file without overflow checking. On 32-bit targets…

  49. 5.3CVE-2026-71392EPSS 0.7%

    GNU Emacs for Android is vulnerable to an integer overflow in the sfnt_read_cmap_format_12() function in src/sfnt.c. When processing a crafted TrueType font file, an unguarded addition in the xmalloc allocation call wraps around on 32-bit …

  50. 7.1CVE-2026-19389EPSS 0.4%

    Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer (asfdemux) when parsing header objects from crafted ASF, WMV, or WMA files. Insufficient validation of attacker-controlled len…