CWE-190— Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.— MITRE CWE catalog

3,331 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-190page 7 of 67

CVE-2016-9557MEDIUMCVSS 5.5EG 5.5
2017-03-23
Integer overflow in jas_image.c in JasPer before 1.900.25 allows remote attackers to cause a denial of service (application crash) via a crafted file.
CVE-2016-9558CRITICALCVSS 9.8EG 9.8
2017-02-28
(1) libdwarf/dwarf_leb.c and (2) dwarfdump/print_frames.c in libdwarf before 20161124 allow remote attackers to have unspecified impact via a crafted bit pattern in a signed leb number, aka a "negation overflow."
CVE-2016-9580HIGHCVSS 3.3EG 8.8
2018-08-01
An integer overflow vulnerability was found in tiftoimage function in openjpeg 2.1.2, resulting in heap buffer overflow.
CVE-2016-9583HIGHCVSS 5.5EG 7.8
2018-08-01
An out-of-bounds heap read vulnerability was found in the jpc_pi_nextpcrl() function of jasper before 2.0.6 when processing crafted input.
CVE-2016-9601MEDIUMCVSS 5.3EG 5.5
2018-04-24
ghostscript before version 9.21 is vulnerable to a heap based buffer overflow that was found in the ghostscript jbig2_decode_gray_scale_image function which is used to decode halftone segments in a JBIG2 image. A document (PostScript or PD…
CVE-2016-9754HIGHCVSS 7.8EG 7.8
2017-01-05
The ring_buffer_resize function in kernel/trace/ring_buffer.c in the profiling subsystem in the Linux kernel before 4.6.1 mishandles certain integer calculations, which allows local users to gain privileges by writing to the /sys/kernel/de…
CVE-2016-9821MEDIUMCVSS 5.5EG 5.5
2017-03-01
Integer overflow in libavcodec/mpegvideo_parser.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via a crafted file.
CVE-2016-9822MEDIUMCVSS 5.5EG 5.5
2017-03-01
Integer overflow in libavcodec/mpeg12dec.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via a crafted file.
CVE-2016-9824MEDIUMCVSS 5.5EG 5.5
2017-03-01
Integer overflow in libswscale/x86/swscale.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via a crafted file.
CVE-2017-0104HIGHCVSS 8.1EG 8.1
2017-03-17
The iSNS Server service in Microsoft Windows Server 2008 SP2 and R2, Windows Server 2012 Gold and R2, and Windows Server 2016 allows remote attackers to issue malicious requests via an integer overflow, aka "iSNS Server Memory Corruption V…
CVE-2017-0307HIGHCVSS 7.8EG 7.8
2017-03-08
An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local perma…
CVE-2017-0309HIGHCVSS 8.8EG 8.8
2017-02-15
All versions of NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where multiple integer overflows may cause improper memory allocation leading to a denial of service or potential escalation of privileges.
CVE-2017-0381HIGHCVSS 7.8EG 7.8
2017-01-12
An information disclosure vulnerability in silk/NLSF_stabilize.c in libopus in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used…
CVE-2017-0383HIGHCVSS 7.8EG 7.8
2017-01-12
An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain loc…
CVE-2017-0410HIGHCVSS 7.8EG 7.8
2017-02-08
An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain loc…
CVE-2017-0521HIGHCVSS 7.0EG 7.0
2017-03-08
An elevation of privilege vulnerability in the Qualcomm camera driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising…
CVE-2017-0553HIGHCVSS 7.0EG 7.0
2017-04-07
An elevation of privilege vulnerability in libnl could enable a local malicious application to execute arbitrary code within the context of the Wi-Fi service. This issue is rated as Moderate because it first requires compromising a privile…
CVE-2017-0576HIGHCVSS 7.0EG 7.0
2017-04-07
An elevation of privilege vulnerability in the Qualcomm crypto engine driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compr…
CVE-2017-0597HIGHCVSS 7.8EG 7.8
2017-05-12
An elevation of privilege vulnerability in Audioserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local acce…
CVE-2017-0603MEDIUMCVSS 4.7EG 4.7
2017-05-12
A denial of service vulnerability in libstagefright in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as Moderate because it requires an uncommon device configurat…
CVE-2017-0611HIGHCVSS 7.0EG 7.0
2017-05-12
An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising …
CVE-2017-0691MEDIUMCVSS 5.5EG 5.5
2017-07-06
A denial of service vulnerability in the Android media framework. Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-36724453.
CVE-2017-0702HIGHCVSS 7.8EG 7.8
2017-07-06
A remote code execution vulnerability in the Android system ui. Product: Android. Versions: 7.1.1, 7.1.2. Android ID: A-36621442.
CVE-2017-0729HIGHCVSS 7.8EG 7.8
2017-08-09
A elevation of privilege vulnerability in the Android media framework (mediadrmserver). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37710346.
CVE-2017-0841HIGHCVSS 7.8EG 7.8
2017-11-16
A remote code execution vulnerability in the Android system (libutils). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-37723026.
CVE-2017-0869HIGHCVSS 7.8EG 7.8
2018-01-12
NVIDIA driver contains an integer overflow vulnerability which could cause a use after free and possibly lead to an elevation of privilege enabling code execution as a privileged process. This issue is rated as high. Version: N/A. Android …
CVE-2017-1000121CRITICALCVSS 9.8EG 9.8
2017-11-01
The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate message size metadata, allowing a compromised secondary process to trigger an integer overflow and subsequent buffer overflow in the UI process.…
CVE-2017-1000158CRITICALCVSS 9.8EG 9.8
2017-11-17
CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)
CVE-2017-1000229HIGHCVSS 7.8EG 7.8
2017-11-17
Integer overflow bug in function minitiff_read_info() of optipng 0.7.6 allows an attacker to remotely execute code or cause denial of service.
CVE-2017-1000422HIGHCVSS 8.8EG 8.8
2018-01-02
Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution
CVE-2017-1000450HIGHCVSS 8.8EG 8.8
2018-01-02
In opencv/modules/imgcodecs/src/utils.cpp, functions FillUniColor and FillUniGray do not check the input length, which can lead to integer overflow. If the image is from remote, may lead to remote code execution or denial of service. This …
CVE-2017-1000470HIGHCVSS 7.5EG 7.5
2018-01-03
EmbedThis GoAhead Webserver versions 4.0.0 and earlier is vulnerable to an integer overflow in the HTTP listener resulting in denial of service.
CVE-2017-10791MEDIUMCVSS 6.5EG 6.5
2017-07-02
There is an Integer overflow in the hash_int function of the libpspp library in GNU PSPP before 0.11.0. For example, a crash was observed within the library code when attempting to convert invalid SPSS data into CSV format. A crafted input…
CVE-2017-10954HIGHCVSS 8.8EG 8.8
2017-10-31
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security Internet Security 2018 prior to build 7.72918. User interaction is required to exploit this vulnerability in …
CVE-2017-11043HIGHCVSS 7.8EG 7.8
2017-12-05
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a WiFI driver function, an integer overflow leading to heap buffer overflow may potentially occur.
CVE-2017-11085HIGHCVSS 7.8EG 7.8
2017-11-16
In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, an integer overflow leading to a buffer overflow due to improper bound checking in msm_audio_effects_virtualizer_handler, file …
CVE-2017-12081HIGHCVSS 7.8EG 7.8
2018-04-24
An exploitable integer overflow exists in the upgrade of a legacy Mesh attribute of the Blender open-source 3d creation suite v2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can al…
CVE-2017-12082HIGHCVSS 7.8EG 7.8
2018-04-24
An exploitable integer overflow exists in the 'CustomData' Mesh loading functionality of the Blender open-source 3d creation suite. A .blend file with a specially crafted external data file can cause an integer overflow resulting in a buff…
CVE-2017-12086HIGHCVSS 7.8EG 7.8
2018-04-24
An exploitable integer overflow exists in the 'BKE_mesh_calc_normals_tessface' functionality of the Blender open-source 3d creation suite. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which c…
CVE-2017-12099HIGHCVSS 7.8EG 7.8
2018-04-24
An exploitable integer overflow exists in the upgrade of the legacy Mesh attribute 'tface' of the Blender open-source 3d creation suite v2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow wh…
CVE-2017-12100HIGHCVSS 7.8EG 7.8
2018-04-24
An exploitable integer overflow exists in the 'multires_load_old_dm' functionality of the Blender open-source 3d creation suite v2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can …
CVE-2017-12101HIGHCVSS 7.8EG 7.8
2018-04-24
An exploitable integer overflow exists in the 'modifier_mdef_compact_influences' functionality of the Blender open-source 3d creation suite v2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflo…
CVE-2017-12102HIGHCVSS 7.8EG 7.8
2018-04-24
An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c converts curves to polygons. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can all…
CVE-2017-12103HIGHCVSS 7.8EG 7.8
2018-04-24
An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c converts text rendered as a font into a curve. A specially crafted .blend file can cause an integer overflow resulting in a buffer over…
CVE-2017-12104HIGHCVSS 7.8EG 7.8
2018-04-24
An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c draws a Particle object. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow f…
CVE-2017-12105HIGHCVSS 7.8EG 7.8
2018-04-24
An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c applies a particular object modifier to a Mesh. A specially crafted .blend file can cause an integer overflow resulting in a buffer ove…
CVE-2017-12108HIGHCVSS 8.8EG 8.8
2018-04-24
An exploitable integer overflow vulnerability exists in the xls_preparseWorkSheet function of libxls 1.4 when handling a MULBLANK record. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An att…
CVE-2017-12109HIGHCVSS 8.8EG 8.8
2018-04-24
An exploitable integer overflow vulnerability exists in the xls_preparseWorkSheet function of libxls 1.4 when handling a MULRK record. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attack…
CVE-2017-12110HIGHCVSS 7.8EG 8.8
2017-11-20
An exploitable integer overflow vulnerability exists in the xls_appendSST function of libxls 1.4.A specially crafted XLS file can cause memory corruption resulting in remote code execution.
CVE-2017-12177CRITICALCVSS 9.8EG 9.8
2018-01-24
xorg-x11-server before 1.19.5 was vulnerable to integer overflow in ProcDbeGetVisualInfo function allowing malicious X client to cause X server to crash or possibly execute arbitrary code.

Map vulnerabilities like CWE-190 to your infrastructure

EchelonGraph correlates every CVE — across CWE-190 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →