CWE-680: Integer Overflow to Buffer Overflow
Filter
The product performs a calculation to determine how much memory to allocate, but an integer overflow can occur that causes less memory to be allocated than expected, leading to a buffer overflow.
What the weakness is: CWE-680 at MITRE. All weaknesses
Related attack patterns (CAPEC): 11
- CAPEC-8 Buffer Overflow in an API Call Likelihood: High · Severity: High
- CAPEC-9 Buffer Overflow in Local Command-Line Utilities Likelihood: High · Severity: High
- CAPEC-10 Buffer Overflow via Environment Variables Likelihood: High · Severity: High
- CAPEC-14 Client-side Injection-induced Buffer Overflow Likelihood: Medium · Severity: High
- CAPEC-24 Filter Failure through Buffer Overflow Likelihood: High · Severity: High
- CAPEC-45 Buffer Overflow via Symbolic Links Likelihood: High · Severity: High
- CAPEC-46 Overflow Variables and Tags Likelihood: High · Severity: High
- CAPEC-47 Buffer Overflow via Parameter Expansion Likelihood: Medium · Severity: High
- CAPEC-67 String Format Overflow in syslog() Likelihood: High · Severity: Very High
- CAPEC-92 Forced Integer Overflow Likelihood: High · Severity: High
- CAPEC-100 Overflow Buffers Likelihood: High · Severity: Very High
The attack patterns MITRE's CAPEC relates to CWE-680, as MITRE names them. Credits.
Ask an AI about CWE-680
Show the prompt
Explain CWE-680: Integer Overflow to Buffer Overflow and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/680.html and https://cve.bz/cve/cwe/680?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 7.0CVE-2026-95107EPSS 0.2%
A ThreadX module chooses `object_size` when it calls `txm_module_object_allocate`. The Module Manager adds its own 16-byte private header to that size and asked the object pool for the result **without checking the addition**. A size near …
- 7.1CVE-2026-91189EPSS 0.1%
The GUIX binary resource loader never checks that a font page's glyph range is well formed. `gx_page_header_first_glyph` and `gx_page_header_last_glyph` are read verbatim from the file and only the upper bound of `last_glyph` is validated,…
- 8.4CVE-2026-76825EPSS 0.6%
RestrictedPython is a tool that helps define a subset of the Python language for accepting program input in a trusted environment. Prior to 8.4, RestrictedPython could allow a sandbox escape when a custom import policy or globals exposed t…
- 8.5CVE-2026-90783EPSS 0.2%
MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib library's ODML superindex parser due to integer wraparound in 32-bit arithmetic. Attackers can craft a malicious AVI file with oversized entry counts that cause…
- 5.3CVE-2026-81647EPSS 0.4%
Out-of-bounds read vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability.
- 9.3CVE-2026-19313EPSS 0.7%
An heap overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.
- 6.9CVE-2026-70651EPSS 0.1%
libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built without libtiff support but with ImageMagick support can overflow the combined frame height while loading a crafted multi-page TIFF th…
- 6.5CVE-2026-19588EPSS 0.4%
Integer Overflow to Buffer Overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers.
- 8.5CVE-2026-43627EPSS 0.2%
llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llama_batch_init() function where unchecked multiplications in malloc() calls can wrap past INT32_MAX when computing allocation sizes. Attackers can pass…
- 9.2CVE-2026-55200EPSS 3.9%
libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large…
- 9.8CVE-2026-8376EPSS 0.6%
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c c…
- 5.5CVE-2026-24928EPSS 0.1%
Out-of-bounds write vulnerability in the file system module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- 5.5CVE-2026-25541EPSS 0.6%
Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "v_capacity >= new_cap …
- 8.8CVE-2025-53510EPSS 0.7%
A memory corruption vulnerability exists in the PSD Image Decoding functionality of the SAIL Image Decoding Library v0.9.8. When loading a specially crafted .psd file, an integer overflow can be made to occur when calculating the stride fo…
- 8.8CVE-2025-52930EPSS 0.9%
A memory corruption vulnerability exists in the BMPv3 RLE Decoding functionality of the SAIL Image Decoding Library v0.9.8. When decompressing the image data from a specially crafted .bmp file, a heap-based buffer overflow can occur which …
- 8.8CVE-2025-52456EPSS 0.9%
A memory corruption vulnerability exists in the WebP Image Decoding functionality of the SAIL Image Decoding Library v0.9.8. When loading a specially crafted .webp animation an integer overflow can be made to occur when calculating the str…
- 8.8CVE-2025-46407EPSS 0.7%
A memory corruption vulnerability exists in the BMPv3 Palette Decoding functionality of the SAIL Image Decoding Library v0.9.8. When loading a specially crafted .bmp file, an integer overflow can be made to occur which will cause a heap-ba…
- 8.8CVE-2025-32468EPSS 0.9%
A memory corruption vulnerability exists in the BMPv3 Image Decoding functionality of the SAIL Image Decoding Library v0.9.8. When loading a specially crafted .bmp file, an integer overflow can be made to occur when calculating the stride …
- 8.6CVE-2025-20263EPSS 0.7%
A vulnerability in the web services interface of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a buffer ove…
- 9.8CVE-2025-54952EPSS 0.7%
An integer overflow vulnerability in the loading of ExecuTorch models can cause smaller-than-expected memory regions to be allocated, potentially resulting in code execution or other undesirable effects. This issue affects ExecuTorch prior…
- 7.5CVE-2025-23326EPSS 0.6%
NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause an integer overflow through a specially crafted input. A successful exploit of this vulnerability might lead to denial of service.
- 6.5CVE-2025-54623EPSS 0.2%
Out-of-bounds read vulnerability in the devicemanager module. Impact: Successful exploitation of this vulnerability may affect availability.
- 8.9CVE-2025-53630EPSS 0.4%
llama.cpp is an inference of several LLM models in C/C++. Integer Overflow in the gguf_init_from_file_impl function in ggml/src/gguf.cpp can lead to Heap Out-of-Bounds Read/Write. This vulnerability is fixed in commit 26a48ad699d50b6268900…
- 7.8CVE-2025-32023ExploitEPSS 6.6%
Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog ope…
- 7.8CVE-2024-48877EPSS 0.3%
A memory corruption vulnerability exists in the Shared String Table Record Parser implementation in xls2csv utility version 0.95. A specially crafted malformed file can lead to a heap buffer overflow. An attacker can provide a malicious fi…
- 7.8CVE-2025-21442EPSS 0.1%
Memory corruption while transmitting packet mapping information with invalid header payload size.
- 7.5CVE-2024-58107EPSS 0.4%
Buffer overflow vulnerability in the codec module Impact: Successful exploitation of this vulnerability may affect availability.
- 7.5CVE-2024-57956EPSS 0.2%
Out-of-bounds read vulnerability in the interpreter string module Impact: Successful exploitation of this vulnerability may affect availability.
- 5.5CVE-2024-56451EPSS 0.1%
Integer overflow vulnerability during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability may affect availability.
- 5.5CVE-2024-55626EPSS 0.2%
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, a large BPF filter file provided to Suricata at startup can lead to a buffer overflow at Suricata startup…
- 7.8CVE-2024-38422EPSS 0.1%
Memory corruption while processing voice packet with arbitrary data received from ADSP.
- 5.3CVE-2024-6381EPSS 0.4%
The bson_strfreev function in the MongoDB C driver library may be susceptible to an integer overflow where the function will try to free memory at a negative offset. This may result in memory corruption. This issue affected libbson version…
- 8.2CVE-2024-37305EPSS 0.4%
oqs-provider is a provider for the OpenSSL 3 cryptography library that adds support for post-quantum cryptography in TLS, X.509, and S/MIME using post-quantum algorithms from liboqs. Flaws have been identified in the way oqs-provider handl…
- 9.8CVE-2024-33078EPSS 1.1%
Tencent Libpag v4.3 is vulnerable to Buffer Overflow. A user can send a crafted image to trigger a overflow leading to remote code execution.
- 5.9CVE-2024-28219EPSS 1.0%
In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.
- 7.8CVE-2024-21470EPSS 0.1%
Memory corruption while allocating memory for graphics.
- 7.5CVE-2024-21454EPSS 0.4%
Transient DOS while decoding the ToBeSignedMessage in Automotive Telematics.
- 8.4CVE-2024-2608EPSS 0.4%
`AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding()` and `AppendEncodedCharacters()` could have experienced integer overflows, causing underallocation of an output buffer leading to an out of bounds write. This vulnerability …
- 7.5CVE-2024-24478EPSS 1.0%
An issue in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the packet-bgp.c, dissect_bgp_open(tvbuff_t*tvb, proto_tree*tree, packet_info*pinfo), optlen components. NOTE: this is disputed by the vendor beca…
- 7.8CVE-2022-36765EPSS 0.3%
EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confident…
- 7.8CVE-2023-33022EPSS 0.2%
Memory corruption in HLOS while invoking IOCTL calls from user-space.
- 7.8CVE-2023-33018EPSS 0.1%
Memory corruption while using the UIM diag command to get the operators name.
- 8.8CVE-2023-28585EPSS 0.1%
Memory corruption while loading an ELF segment in TEE Kernel.
- 5.5CVE-2023-22305EPSS 0.2%
Integer overflow in some Intel(R) Aptio* V UEFI Firmware Integrator Tools may allow an authenticated user to potentially enable denial of service via local access.
- 8.8CVE-2023-37536EPSS 1.9%
An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request.
- 7.8CVE-2023-21644EPSS 0.1%
Memory corruption in RIL due to Integer Overflow while triggering qcril_uim_request_apdu request.
- 7.8CVE-2023-21648EPSS 0.1%
Memory corruption in RIL while trying to send apdu packet.
- 8.8CVE-2022-24834EPSS 41%
Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem ex…
- 5.5CVE-2023-22443EPSS 0.2%
Integer overflow in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable denial of service via local access.
- 7.8CVE-2022-33296EPSS 0.1%
Memory corruption due to integer overflow to buffer overflow in Modem while parsing Traffic Channel Neighbor List Update message.