cve.bz

CWE-191: Integer Underflow (Wrap or Wraparound), page 4

Filter

The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

What the weakness is: CWE-191 at MITRE

Ask an AI about CWE-191

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-191: Integer Underflow (Wrap or Wraparound) and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/191.html and https://cve.bz/cve/cwe/191?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.9CVE-2026-59090EPSS 0.6%

    A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enab…

  2. 7.1CVE-2026-70633EPSS 0.5%

    TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability in the Gorilla compression reverse row iterator that allows authenticated attackers to cause a denial of service by storing a crafted compres…

  3. 8.5CVE-2026-43628EPSS 0.2%

    llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dry_a…

  4. 2.2CVE-2026-18839EPSS 0.1%

    An integer underflow was found in the popt library when formatting help text for option tables that exceed the terminal width. A local user who can cause an application to print help under those conditions may cause that application to cra…

  5. 7.5CVE-2026-71202EPSS 0.5%

    The raster Rust crate's crop function (src/editor.rs) clamps the crop width/height against source dimensions but only clamps the offset_x/offset_y parameters against 0, never against the source width/height.

  6. 6.5CVE-2026-24077EPSS 0.2%

    Information Disclosure when processing wireless network channel switch information with improperly formatted length fields.

  7. 8.7CVE-2026-67298EPSS 0.7%

    FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler (rail_server_handle_messages() in channels/rail/server/rail_main.c). When processing a RAIL PDU header, the code subtracts RAIL_PDU_…

  8. 8.2CVE-2026-63362EPSS 1.8%

    An unsigned integer underflow in the PubSub signature verification path in open62541 may allow a remote attacker to cause a denial of service via a crafted UDP packet.

  9. 8.1CVE-2026-13308EPSS 0.8%

    Autel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers…

  10. 6.9CVE-2026-54345EPSS 0.8%

    gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes an AVP data length by subtracting a fixed header size from an attacker-controlled AVP Length field, so a vendor-flagge…

  11. 5.5CVE-2026-42495EPSS 0.2%

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from…

  12. 8.2CVE-2026-54890EPSS 0.4%

    Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emu…

  13. 7.8CVE-2026-64361EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length check_and_correct_requested_length() compares (off + len) against node_size using u32 arithmetic. Wh…

  14. 8.7CVE-2026-66033EPSS 0.6%

    libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negoti…

  15. 8.8CVE-2026-45813EPSS 0.5%

    Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apache NimBLE BASS service. Improper validation when parsing BASS service  "Add Source" and "Modify Source" operation PDU could results in stack buffer overflow o…

  16. 7.3CVE-2026-65704EPSS 0.2%

    FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements pack…

  17. 7.1CVE-2026-48029EPSS 0.4%

    libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 have a heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow. Version 1.22.0 fixes the issue.

  18. 9.8CVE-2026-64047EPSS 0.5%

    In the Linux kernel, the following vulnerability has been resolved: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring When an sk_msg scatterlist ring wraps (sg.end < sg.start), tls_push_record() chains the tail por…

  19. 7.8CVE-2026-64009EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: xfrm: Check for underflow in xfrm_state_mtu Leo Lin reported OOB write issue in esp component: xfrm_state_mtu() returns u32 but performs its arithmetic in unsigned …

  20. 9.3CVE-2026-63940EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Ignore Port I/O requests of length '0' Explicitly ignore Port I/O requests of length '0' (or count '0'), so that setting up the software scratch area (and othe…

  21. 5.5CVE-2026-63868EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: net: garp: fix unsigned integer underflow in garp_pdu_parse_attr The receive-side GARP attribute parser computes dlen with reversed operands: dlen = sizeof(*ga)…

  22. 6.5CVE-2026-44251EPSS 0.4%

    Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 3.0.0 and above, prior to 4.14.5, a size_t integer underflow in os_crypto/shared/msgs.c:389 allows any enrolled Wazuh agent to crash …

  23. 2.1CVE-2026-40955EPSS 0.3%

    CVE-2026-40955 is an integer underflow vulnerability in the traffic parsing function of Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS a…

  24. 2.1CVE-2026-40954EPSS 0.3%

    CVE-2026-40954 is an integer underflow vulnerability in the traffic parsing function of Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS a…

  25. 6.2CVE-2026-48298EPSS 0.3%

    CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denia…

  26. 6.2CVE-2026-48296EPSS 0.3%

    CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denia…

  27. 7.8CVE-2026-55039EPSS 0.5%

    Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  28. 7.8CVE-2026-50498EPSS 0.4%

    Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

  29. 7.8CVE-2026-50388EPSS 0.5%

    Out-of-bounds read in Windows NTFS allows an unauthorized attacker to execute code locally.

  30. 7.8CVE-2026-55011EPSS 0.5%

    Integer underflow (wrap or wraparound) in Microsoft Defender allows an unauthorized attacker to execute code locally.

  31. 8.8CVE-2026-54982EPSS 0.5%

    Integer underflow (wrap or wraparound) in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent network.

  32. 7.8CVE-2026-50308EPSS 0.5%

    Integer underflow (wrap or wraparound) in Windows NTFS allows an unauthorized attacker to execute code locally.

  33. 5.5CVE-2026-50300EPSS 0.4%

    Integer underflow (wrap or wraparound) in Windows Kernel allows an authorized attacker to disclose information locally.

  34. 7.8CVE-2026-49790EPSS 0.4%

    Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

  35. 9.8CVE-2026-49181EPSS 1.2%

    Integer underflow (wrap or wraparound) in Windows DHCP Client allows an unauthorized attacker to elevate privileges over a network.

  36. 9.8CVE-2026-51540EPSS 0.6%

    OpENer 2.3.0 (master branch up to commit 76b95cf) is vulnerable to a severe memory corruption issue caused by an integer underflow in the processing of connected explicit messages (SendUnitData).

  37. 8.7CVE-2026-29008EPSS 0.7%

    U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c) that allows a network-adjacent attacker to crash the bootloader by sending a malformed TCP SYN+ACK packet with a mani…

  38. 6.5CVE-2026-55490EPSS 0.7%

    OpenWrt is a Linux operating system targeting embedded devices. Before v25.12.5, an integer underflow in handle_send_a() of the Emergency Access Daemon allows any unauthenticated attacker on the local network to crash the daemon by sending…

  39. 9.1CVE-2026-58016EPSS 0.6%

    A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other eleme…

  40. 6.9CVE-2026-58058ExploitEPSS 1.5%

    Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a larg…

  41. 7.1CVE-2026-57918EPSS 0.3%

    libnfs through 6.0.2 before 935b8db has an xid integer underflow in READ_IOVEC in rpc_read_from_socket in lib/socket.c during a connection to a crafted NFS server, when the expected pdu size exceeds the absolute pdu size from the xid/recor…

  42. 1.0CVE-2026-6678EPSS 0.3%

    Integer underflow in wc_PKCS7_DecryptOri when handling crafted Other Recipient Info, leading to incorrect length handling during decryption.

  43. 5.5CVE-2026-57452EPSS 0.2%

    Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt~04! or VimCrypt~05! method (xchacha20poly1305, requires the +sodium feature) whose body is shorter than a single libsodiu…

  44. 8.1CVE-2026-53178EPSS 0.4%

    In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction Add guards to ensure ie_length is large enough before subtracting fixed IE offsets to preven…

  45. 9.8CVE-2026-53176EPSS 0.8%

    In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length a…

  46. 5.5CVE-2026-53150EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Reject zero-length property entries in validator tb_property_entry_valid() accepts entries with length == 0 for DIRECTORY, DATA, and TEXT types. A zero-len…

  47. 7.8CVE-2026-53130EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START omfs_fill_super() rejects oversized s_sys_blocksize values (> PAGE_SIZE), but it does not reject values small…

  48. 7.8CVE-2026-52919EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix tp_meter counter underflow during shutdown batadv_tp_sender_shutdown() unconditionally decrements the "sending" atomic counter. If multiple paths (e.g. t…

  49. 8.8CVE-2026-30803EPSS 0.3%

    Integer Underflow (Wrap or Wraparound) vulnerability in RTI Connext Micro (Core Libraries) allows Overread Buffers. This issue affects Connext Micro: from 4.0.0 before 4.3.0.

  50. 7.8CVE-2026-54413EPSS 0.4%

    driftregion iso14229 through 0.9.0 contains an integer underflow and downstream out-of-bounds read in the Handle_0x27_SecurityAccess function in iso14229.c that allows a remote unauthenticated attacker to crash a UDS server and potentially…