cve.bz

CWE-191: Integer Underflow (Wrap or Wraparound)

Filter

The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

What the weakness is: CWE-191 at MITRE

Ask an AI about CWE-191

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-191: Integer Underflow (Wrap or Wraparound) and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/191.html and https://cve.bz/cve/cwe/191?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. –CVE-2026-20576

    In afe, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation…

  2. –CVE-2026-20572

    In adsp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. …

  3. 7.1CVE-2026-111735EPSS 0.2%

    P-Net before 1.0.3 contains an integer underflow in pf_cpm_c_data_ind(). When handling a received cyclic data frame while the consumer is in the FRUN or RUN state, the offset of the APDU status was computed as the frame length minus 4 usin…

  4. 7.1CVE-2026-103411EPSS 0.2%

    An Integer Underflow vulnerability in DhcpMessageDecoder in Juniper Networks Session Smart Router allows an attacker with local network access to cause information disclosure and a denial of service via a malicious DHCP reply.

  5. 7.1CVE-2026-82947EPSS 0.2%

    SOEM version 2.0.0 and earlier contains multiple vulnerabilities in frame processing where a malicious device can cause the master to read data outside allocated buffers. The software uses length and offset values from device messages with…

  6. 8.3CVE-2026-70388EPSS 0.2%

    SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device on the network can send specially crafted messages that cause the master to write data outside allocated memory boundaries. The software performs arithmetic o…

  7. 7.7CVE-2026-111808EPSS 0.4%

    Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through …

  8. 7.5CVE-2026-74755EPSS 0.6%

    An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash a bRPC server by sending a request containing a string field with a zero value_size. The UnparsedValue::as_…

  9. 7.5CVE-2026-56386EPSS 0.7%

    Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-lengt…

  10. 8.7CVE-2026-111075EPSS 0.4%

    In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`, `_paddingSize`, and `_dataOffset` fields during `DataDescriptor` message deserialization. An unauth…

  11. 8.7CVE-2026-92853EPSS 0.3%

    The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned lengt…

  12. 6.8CVE-2026-112010EPSS 0.1%

    smpeg through 2.0.0 contains an integer underflow vulnerability in stream_header() in MPEGsystem.cpp that allows attackers to wrap packet_size by declaring an undersized packet length. Attackers can supply a crafted MPEG file opened via SM…

  13. 7.2CVE-2026-111881EPSS 0.2%

    FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE_MAX - 3 to Stream_Zero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bp…

  14. 9.8CVE-2026-49868EPSS 0.4%

    RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, _parse_reply() in sys/net/application_layer/dhcpv6/client.c omits minimum-length validation befor…

  15. 7.5CVE-2026-48503EPSS 0.5%

    libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, the MMS file service in src/mms/iso_mms/server/mms_file_service.c accepts an out-of-…

  16. 7.5CVE-2026-73252EPSS 0.4%

    Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MG_TLS_BUILTIN in src/tls_builtin.c accepts a TLS 1.3 record whose decrypted size is exactly the 16-byte authentication tag with no p…

  17. 6.5CVE-2026-86566EPSS 0.2%

    A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK.

  18. 8.7CVE-2026-106464EPSS 0.2%

    `_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv_length - 1` without first checking that `tlv_length` is non-zero. A certificate whose signature is an empty ASN.1 BIT STRING therefore parses succes…

  19. 5.9CVE-2026-75083EPSS 0.2%

    The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41z_rx() in drivers/ieee802154/ieee802154_kw41z.c, computed the payload size as pkt_len = len - KW41Z_FCS_LENGTH in a uint8_t, where len is the frame length reported by the radio. T…

  20. 9.3CVE-2026-101980EPSS 0.5%

    An Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS with Extended Echo configured allows an unauthenticated, network-based attacker to cause a denial of service by a kernel crash.

  21. 5.3CVE-2026-101968EPSS 0.2%

    An Integer Underflow (Wrap or Wraparound) vulnerability in the rpd process of Juniper Networks Junos OS on EX Series and MX Series, and Junos OS Evolved on ACX Series allows an unauthenticated adjacent attacker to cause heap memory disclos…

  22. 7.1CVE-2026-101938EPSS 0.2%

    An Integer Underflow (Wrap or Wraparound) vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an adjacent unauthenticated attacker to cause a forwarding-plane denial of service via an ICMP…

  23. 7.1CVE-2026-110714EPSS 0.5%

    libsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned s…

  24. 5.3CVE-2026-50216EPSS 0.3%

    An integer underflow exists in the DNS proxy component of the macOS NetworkExtension system extension shipped with Akamai Guardicore Platform Agent (GPA) for macOS, whereby if a UDP datagram shorter than 96 bytes that begins with a specifi…

  25. 7.1CVE-2026-88964EPSS 0.4%

    An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options

  26. 8.8CVE-2026-97746EPSS 0.9%

    Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

  27. 8.8CVE-2026-97739EPSS 0.8%

    Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

  28. 8.8CVE-2026-97004EPSS 0.9%

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

  29. 5.5CVE-2026-96925EPSS 0.4%

    Integer underflow (wrap or wraparound) in Windows NTFS allows an authorized attacker to disclose information locally.

  30. 8.0CVE-2026-96844EPSS 0.5%

    Integer underflow (wrap or wraparound) in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges over an adjacent network.

  31. 6.5CVE-2026-88195EPSS 0.8%

    Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

  32. 7.8CVE-2026-88143EPSS 0.2%

    Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.

  33. 9.8CVE-2026-85806EPSS 0.9%

    Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.

  34. 8.8CVE-2026-85339EPSS 0.5%

    Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine

  35. 9.8CVE-2026-83869EPSS 0.8%

    Integer underflow (wrap or wraparound) in DNS Server allows an unauthorized attacker to execute code over a network.

  36. 7.5CVE-2026-83855EPSS 1.3%

    Integer underflow (wrap or wraparound) in Windows WLAN Service allows an unauthorized attacker to deny service over a network.

  37. 8.0CVE-2026-83838EPSS 0.6%

    Integer underflow (wrap or wraparound) in Windows Bluetooth A2DP driver allows an authorized attacker to elevate privileges over an adjacent network.

  38. 7.8CVE-2026-83836EPSS 0.5%

    Heap-based buffer overflow in Windows Event Tracing allows an unauthorized attacker to execute code locally.

  39. 7.0CVE-2026-83676EPSS 0.3%

    Integer underflow (wrap or wraparound) in Windows Installer allows an authorized attacker to elevate privileges locally.

  40. 9.8CVE-2026-83578EPSS 1.1%

    Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthorized attacker to execute code over a network.

  41. 7.8CVE-2026-70064EPSS 0.4%

    Integer underflow (wrap or wraparound) in Windows Kerberos allows an authorized attacker to elevate privileges locally.

  42. 7.5CVE-2026-102192EPSS 1.3%

    Integer underflow (wrap or wraparound) in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.

  43. 9.8CVE-2026-100222EPSS 1.1%

    Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.

  44. 6.5CVE-2026-88833EPSS 0.2%

    A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to …

  45. 7.5CVE-2026-102702EPSS 0.3%

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] 1) XSA-437 (CVE-2023-34321) addressed issues with overflows in calculations involved in guests flushing ca…

  46. 7.5CVE-2026-102699EPSS 0.3%

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] 1) XSA-437 (CVE-2023-34321) addressed issues with overflows in calculations involved in guests flushing ca…

  47. 3.5CVE-2026-65200EPSS 0.1%

    The openUBMC device-management process parses PLDM-over-MCTP and NCSI-over-MCTP responses from on-bus devices, and three response parsers in the shared transport libraries subtract a fixed header or reserved-field size from a device-suppli…

  48. 8.8CVE-2026-102073EPSS 0.3%

    A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BA…

  49. 7.5CVE-2026-58249EPSS 0.4%

    SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handlin…

  50. 3.5CVE-2026-58242EPSS 0.2%

    SAP Cloud Connector contains an improper authorization check, which could be exploited by a low-privileged attacker through specially crafted requests. Exploitation requires the attacker to be on an adjacent network. Successful exploitatio…