cve.bz

CWE-191: Integer Underflow (Wrap or Wraparound), page 2

Filter

The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

What the weakness is: CWE-191 at MITRE

Ask an AI about CWE-191

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-191: Integer Underflow (Wrap or Wraparound) and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/191.html and https://cve.bz/cve/cwe/191?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2026-53922EPSS 0.6%

    odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain two bindings through normal DHCPv6 SOLICIT and REQUEST exchanges and th…

  2. 7.1CVE-2026-109246EPSS 0.4%

    FreeRDP before 3.32.0 contains a divide-by-zero vulnerability in the freerdp-shadow-cli shadow server: the frame id in a client's Frame Acknowledge PDU is stored without a range check, so the in-flight frame count in shadow_encoder_infligh…

  3. 7.5CVE-2026-107794EPSS 0.4%

    ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call av_extend( av, len-1 ). On an empty list, this undeflows, and av_extend will allocate an array with 2^32 slots,…

  4. 7.5CVE-2013-10076EPSS 0.4%

    ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call av_extend( av, len-1 ). On an empty list, this undeflows, and av_extend will allocate an array with 2^32 slot…

  5. 7.5CVE-2026-103636EPSS 0.4%

    Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ (repo: datasketches-cpp). var_opt_union::deserialize() read the 32-byte preamble of a non-empty union after checking that only 8 bytes were available, so a …

  6. 7.5CVE-2026-75352EPSS 0.4%

    OpENer v2.3/commit 76b95cf, contains an integer underflow in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a denial of service

  7. 7.1CVE-2026-107836EPSS 0.3%

    RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, the nanoCoAP client function nanocoap_sock_get_slice() in sys/net/application_layer/nanocoa…

  8. 5.9CVE-2026-106437EPSS 0.1%

    The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document bu…

  9. 7.1CVE-2026-106429EPSS 0.3%

    An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that terminates the application process. This can occur when an authenticated user modifies a key document in the key vault col…

  10. 6.9CVE-2026-107635EPSS 0.1%

    Dislocker through 0.7.3 contains an integer underflow vulnerability in get_vmk() and get_fvek() that allows attackers to trigger out-of-bounds heap reads via crafted datum sizes. Attackers can supply a malicious BitLocker volume image with…

  11. 6.1CVE-2026-107614EPSS 0.1%

    An integer underflow in WinCursorShapeUtils::trimTransparent() in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to crash the server, and potentially read out-of-bounds memory, by causing a cursor shap…

  12. 8.1CVE-2026-19186EPSS 0.2%

    ieee802154_decipher_data_frame() in subsys/net/l2/ieee802154/ieee802154_frame.c computed payload_len = net_pkt_get_len(pkt) - ll_hdr_len - authtag_len without first checking that the received frame is at least ll_hdr_len + authtag_len byte…

  13. 5.3CVE-2026-83742EPSS 0.4%

    Unsigned integer underflow in wstrncat() in src/port.c in wolfSSL wolfSSH from v1.4.11 through v1.5.0 on non-Windows platforms allows an authenticated remote attacker to write one out-of-bounds null byte past the end of a stack buffer by s…

  14. 7.1CVE-2026-102168EPSS 0.3%

    On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled SSID can crash the portal service with a crafted HTTP request. This results in a temporary denial …

  15. 9.3CVE-2026-84411EPSS 0.9%

    The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbit…

  16. 8.7CVE-2026-86537EPSS 0.4%

    Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparound) vulnerability in Apache Thrift D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recomme…

  17. 8.2CVE-2026-82459EPSS 0.3%

    Integer underflow (wrap or wraparound), Out-of-bounds write vulnerability in Apache Thrift C++ 32 bit THeaderTransport. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes …

  18. 7.8CVE-2026-47585EPSS 0.1%

    NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause an integer underflow. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation …

  19. 7.8CVE-2026-47540EPSS 0.1%

    NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an integer underflow. A successful exploit of this vulnerability might lead to code execution, denial of servic…

  20. 8.2CVE-2026-86133EPSS 0.3%

    An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has completed the initial IKEv2 handshake to crash the iked process by sending a specially crafted encrypted IKEv2 message, res…

  21. 8.2CVE-2026-86132EPSS 0.4%

    An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated attacker to crash the process by sending a specially crafted encrypted IKEv2 message negotiated with an AES-GCM cipher su…

  22. 7.1CVE-2026-102714EPSS 0.2%

    `_nx_icmpv6_validate_options()` scans the option area with `while (length > 2)` (`common/src/nx_icmpv6_validate_options.c:79`). An area whose size leaves a one- or two-byte residue exits the loop with that tail unexamined; the residue is n…

  23. 6.8CVE-2026-18747EPSS 0.1%

    The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length from it, verifies a CRC and then unconditionally strips the trailing CRC with rx_ctxt->nb->len -= 2U; in mcumgr_serial_process_frag() (subsys/mgmt/m…

  24. 6.2CVE-2026-88377EPSS 0.2%

    Bento4 1.6.0.0 contains an integer underflow vulnerability in the avcC and hvcC configuration atom parsers. A specially crafted MP4 file containing an atom with a declared size smaller than AP4_ATOM_HEADER_SIZE can cause AP4_AvccAtom::Crea…

  25. 7.5CVE-2026-88376EPSS 0.4%

    Bento4 1.6.0.0 contains an integer underflow vulnerability in AP4_AvccAtom::Create() and AP4_HvccAtom::Create(). A specially crafted MP4 file containing an avcC or hvcC atom with a declared size smaller than the atom header size can cause …

  26. 4.4CVE-2026-17504EPSS 0.1%

    IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the partition firmware runtime. An attacker with root access to a…

  27. 4.8CVE-2026-95958EPSS 0.2%

    A security flaw has been discovered in JusticeRage Manalyze 1.0.0. Impacted is the function PE::_parse_relocations of the file manape/pe.cpp of the component PE Parser. Performing a manipulation of the argument BlockSize results in integer…

  28. 4.4CVE-2026-81881EPSS 0.2%

    radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O Swift field-metadata parser was vulnerable because a relative Swift field pointer could be lower than the field-metadata sectio…

  29. 5.3CVE-2026-94090EPSS 0.4%

    A security flaw has been discovered in JusticeRage Manalyze 1.0.0. The affected element is the function PE::_parse_debug of the file manape/pe.cpp of the component PE Parser. The manipulation of the argument misc.Length results in integer …

  30. 6.2CVE-2026-61720EPSS 0.2%

    FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the SF2 parser computes the DMOD modulator count as chunk.size / SF_MOD_SIZE - 1 without rejecting chunks smaller than one record. A craf…

  31. 8.7CVE-2026-93599EPSS 0.3%

    rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose content is exactly [0x00] (zero…

  32. 6.9CVE-2026-93395EPSS 0.4%

    A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does …

  33. 6.5CVE-2026-44235EPSS 0.3%

    rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized HEADER or METHOD frame during client login and cause unsigned size_t underflow in amqp_handle_input() in librabbit…

  34. 5.1CVE-2026-91103EPSS 1.0%

    HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, infor…

  35. 8.2CVE-2026-89028EPSS 0.6%

    MikroTik RouterOS before 7.24 contains a heap memory corruption vulnerability in the userspace SMB daemon that allows remote attackers to corrupt adjacent heap memory by supplying a crafted uniPwdLen value in the SMB1 SessionSetupAndX hand…

  36. 7.7CVE-2026-91948EPSS 0.6%

    FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static virtual channel handling when CHANNEL_OPTION_SHOW_PROTOCOL is enabled. Authenticated clients can queue oversized channel messages that cause …

  37. 5.5CVE-2026-90996EPSS 0.1%

    A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services (NSS) responder. This could lead to a denial-of-service condition, causing the NSS responde…

  38. 6.9CVE-2026-13326EPSS 0.2%

    An out-of-bounds read in Qt NFC's language code length parsing allows a physically proximate attacker to cause a denial of service or limited memory disclosure via a crafted NFC tag.

  39. 5.5CVE-2026-81977EPSS 0.3%

    Acrobat Reader is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this …

  40. 7.5CVE-2026-66307EPSS 1.2%

    Integer underflow (wrap or wraparound) in Skype for Business allows an unauthorized attacker to deny service over a network.

  41. 6.5CVE-2026-78453EPSS 0.9%

    Integer underflow (wrap or wraparound) in Microsoft Windows SCSI Class System File allows an unauthorized attacker to disclose information over a network.

  42. 5.5CVE-2026-77488EPSS 0.4%

    Integer underflow (wrap or wraparound) in SQL Server allows an authorized attacker to disclose information locally.

  43. 7.0CVE-2026-72947EPSS 0.3%

    Integer underflow (wrap or wraparound) in Windows File History Service allows an authorized attacker to elevate privileges locally.

  44. 8.8CVE-2026-71352EPSS 0.9%

    Integer underflow (wrap or wraparound) in Windows Remote Access Connection Manager allows an authorized attacker to execute code over a network.

  45. 7.0CVE-2026-69859EPSS 0.2%

    Time-of-check time-of-use (toctou) race condition in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to elevate privileges locally.

  46. 9.8CVE-2026-69824EPSS 1.0%

    Integer underflow (wrap or wraparound) in Microsoft Standard XPS allows an unauthorized attacker to execute code over a network.

  47. 7.8CVE-2026-69687EPSS 0.3%

    Integer underflow (wrap or wraparound) in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to elevate privileges locally.

  48. 7.8CVE-2026-69421EPSS 0.3%

    Integer underflow (wrap or wraparound) in Windows Kernel Mode Driver allows an authorized attacker to elevate privileges locally.

  49. 5.5CVE-2026-69303EPSS 0.4%

    Out-of-bounds read in Push Message Routing Service allows an authorized attacker to disclose information locally.

  50. 9.8CVE-2026-69276EPSS 1.0%

    Integer underflow (wrap or wraparound) in Microsoft UxTheme Library (uxtheme.dll) allows an unauthorized attacker to execute code over a network.