CWE-190— Integer Overflow or Wraparound

Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally.

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. Processing an image may lead to arbitrary code…

An integer overflow was addressed with improved input validation. This issue is fixed in Safari 26.6.1, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead…

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in Safari 26.6.1, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content …

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected sys…

An integer overflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause a denial of service.

An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to trigger an out-of-bounds write.

Integer overflow or wraparound in Windows DNS allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Storage Port Driver allows an authorized attacker to elevate privileges locally.

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A truncated tga can leave a pending gif frame that is process…

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value…

An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash. An unauthenticated remote attacker can crash PgBouncer with a malformed SCRAM authentication packet.

A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin allocates memory for a row table. The image header dimensions (ysize and zsize) are read as 16-bit unsigned integers. If a crafted fil…

A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and height. If a crafted file sets both values to large values, their…

A heap buffer overflow could occur in the DTLS 1.3 ACK serialization path before the connecting peer is authenticated. The buffer overflow was due to an integer truncation when computing the length of the ACK record-number list, causing an…

In FatFS R0.16 and earlier contains a FAT32 integer overflow bug in mount_volume() where fasize *= fs->n_fats can wrap, leading to attacker-controlled file-size metadata and unsafe read lengths in downstream callers. This maps to CWE-190 (…

Integer overflow or wraparound in SQL Server allows an unauthorized attacker to deny service over a network.

Integer overflow or wraparound in SQL Server allows an authorized attacker to execute code over a network.

Integer overflow or wraparound in SQL Server allows an authorized attacker to deny service over a network.

Denial-of-service due to integer overflow in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

Incorrect boundary conditions, integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an unauthenticated remote client can send a STUN message over TCP or TLS with a body-length field from 65520 through 65532, causing the uint16_t len vari…

Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network.

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, a crafted many-band TIFF processed through VipsForeignLoadTiff can evade scanline validation in libvips/iofuncs/image.c and cause an integer overflo…

Integer overflow or wraparound in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

Integer overflow or wraparound in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

Out-of-bounds read in BranchCache allows an unauthorized attacker to deny service over a network.

Integer overflow or wraparound in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.

Integer overflow or wraparound in Volume Manager Driver allows an authorized attacker to elevate privileges locally.

Integer overflow or wraparound in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.

Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code over a network.

Integer overflow or wraparound in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to elevate privileges with a physical attack.

Integer overflow or wraparound in Windows Imaging Component allows an unauthorized attacker to execute code over a network.

Integer overflow or wraparound in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.

Integer overflow or wraparound in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.

Integer overflow or wraparound in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

Integer overflow or wraparound in Windows DNS allows an unauthorized attacker to deny service over a network.

Integer overflow or wraparound in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to elevate privileges locally.

Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.

Integer overflow or wraparound in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

Integer overflow or wraparound in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network.

Integer overflow or wraparound in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.

Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

Integer overflow or wraparound in Microsoft WebP Image Extension allows an unauthorized attacker to execute code over a network.

rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero …

Integer overflow or wraparound in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

Integer overflow or wraparound in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted …