CWE-190
AllowedInteger Overflow or Wraparound
Abstraction: Base · Status: Stable
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
4655 vulnerabilities reference this CWE, most recent first.
GHSA-24XR-JC8X-C65V
Vulnerability from github – Published: 2022-05-14 01:31 – Updated: 2025-01-21 18:31Integer overflow in the Embedded OpenType (EOT) Font Engine in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows remote attackers to execute arbitrary code via a crafted table in an embedded font, aka "Embedded OpenType Font Integer Overflow Vulnerability."
{
"affected": [],
"aliases": [
"CVE-2010-1883"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2010-10-13T19:00:00Z",
"severity": "HIGH"
},
"details": "Integer overflow in the Embedded OpenType (EOT) Font Engine in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows remote attackers to execute arbitrary code via a crafted table in an embedded font, aka \"Embedded OpenType Font Integer Overflow Vulnerability.\"",
"id": "GHSA-24xr-jc8x-c65v",
"modified": "2025-01-21T18:31:01Z",
"published": "2022-05-14T01:31:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1883"
},
{
"type": "WEB",
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-076"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6881"
},
{
"type": "WEB",
"url": "http://www.us-cert.gov/cas/techalerts/TA10-285A.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2546-5J9R-QGGH
Vulnerability from github – Published: 2022-05-14 02:00 – Updated: 2022-05-14 02:00The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resultant buffer overflow, and application crash) or possibly have unspecified other impact via vectors involving long user and password fields.
{
"affected": [],
"aliases": [
"CVE-2017-8816"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-11-29T18:29:00Z",
"severity": "CRITICAL"
},
"details": "The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resultant buffer overflow, and application crash) or possibly have unspecified other impact via vectors involving long user and password fields.",
"id": "GHSA-2546-5j9r-qggh",
"modified": "2022-05-14T02:00:02Z",
"published": "2022-05-14T02:00:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-8816"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:3558"
},
{
"type": "WEB",
"url": "https://curl.haxx.se/docs/adv_2017-12e7.html"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201712-04"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2017/dsa-4051"
},
{
"type": "WEB",
"url": "http://security.cucumberlinux.com/security/details.php?id=161"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/101998"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1039896"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1040608"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2566-P8JV-48Q3
Vulnerability from github – Published: 2022-05-14 03:05 – Updated: 2022-05-14 03:05The sell function of a smart contract implementation for MyYLC, an Ethereum token, has an integer overflow in which "amount * sellPrice" can be zero, consequently reducing a seller's assets.
{
"affected": [],
"aliases": [
"CVE-2018-13225"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-05T02:29:00Z",
"severity": "HIGH"
},
"details": "The sell function of a smart contract implementation for MyYLC, an Ethereum token, has an integer overflow in which \"amount * sellPrice\" can be zero, consequently reducing a seller\u0027s assets.",
"id": "GHSA-2566-p8jv-48q3",
"modified": "2022-05-14T03:05:26Z",
"published": "2022-05-14T03:05:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-13225"
},
{
"type": "WEB",
"url": "https://github.com/BlockChainsSecurity/EtherTokens/blob/master/ETHEREUMBLACK/sell%20integer%20overflow.md"
},
{
"type": "WEB",
"url": "https://github.com/BlockChainsSecurity/EtherTokens/tree/master/MyYLCToken"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-2586-JX35-M7R7
Vulnerability from github – Published: 2022-05-24 16:53 – Updated: 2023-03-02 18:30_TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. This can, for example, lead to an application crash.
{
"affected": [],
"aliases": [
"CVE-2019-14973"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-14T06:15:00Z",
"severity": "MODERATE"
},
"details": "_TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. This can, for example, lead to an application crash.",
"id": "GHSA-2586-jx35-m7r7",
"modified": "2023-03-02T18:30:27Z",
"published": "2022-05-24T16:53:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14973"
},
{
"type": "WEB",
"url": "https://gitlab.com/libtiff/libtiff/merge_requests/90"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2019/08/msg00031.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/63BVT6N5KQPHWOWM4B3I7Z3ODBXUVNPS"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ADNPG7JJTRRK22GUVTAFH3GJ6WGKUZJB"
},
{
"type": "WEB",
"url": "https://seclists.org/bugtraq/2019/Nov/5"
},
{
"type": "WEB",
"url": "https://seclists.org/bugtraq/2020/Jan/32"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2020/dsa-4608"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2020/dsa-4670"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00102.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00023.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/155095/Slackware-Security-Advisory-libtiff-Updates.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-259C-37PX-2X76
Vulnerability from github – Published: 2022-05-01 17:52 – Updated: 2025-04-03 15:30Integer overflow in the 16 bit variable reference counter in PHP 4 allows context-dependent attackers to execute arbitrary code by overflowing this counter, which causes the same variable to be destroyed twice, a related issue to CVE-2007-1286.
{
"affected": [],
"aliases": [
"CVE-2007-1383"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2007-03-10T00:19:00Z",
"severity": "HIGH"
},
"details": "Integer overflow in the 16 bit variable reference counter in PHP 4 allows context-dependent attackers to execute arbitrary code by overflowing this counter, which causes the same variable to be destroyed twice, a related issue to CVE-2007-1286.",
"id": "GHSA-259c-37px-2x76",
"modified": "2025-04-03T15:30:40Z",
"published": "2022-05-01T17:52:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2007-1383"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/24606"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/25056"
},
{
"type": "WEB",
"url": "http://security.gentoo.org/glsa/glsa-200703-21.xml"
},
{
"type": "WEB",
"url": "http://www.novell.com/linux/security/advisories/2007_32_php.html"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/32770"
},
{
"type": "WEB",
"url": "http://www.php-security.org/MOPB/MOPB-01-2007.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/22765"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-259R-337F-4RFW
Vulnerability from github – Published: 2026-10-20 14:33 – Updated: 2026-10-20 14:33Signed Integer Overflow in s2.NewDict
Summary
A signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV.
Package
- Name:
github.com/klauspost/compress/s2 - Ecosystem: Go
- Affected versions: <= v1.18.6 (all versions with
NewDictfunction)
Severity
High (7.5) — CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability
Type
- CWE-190: Integer Overflow or Wraparound
- CWE-787: Out-of-bounds Write (via unsafe.Pointer)
Description
The NewDict() function reads a uvarint from dictionary data and converts it to int:
r, n := binary.Uvarint(dict)
// ...
d.repeat = int(r)
if d.repeat > len(dict) {
return nil
}
When r exceeds MaxInt64 (9223372036854775807), int(r) overflows to a negative value. Since a negative number is never greater than a positive length, the validation check is bypassed.
When Dict.Encode() is called, the negative repeat value causes an integer overflow in encodeBlockDictGo():
repeat := len(dict.dict) - dict.repeat // overflows: 62 - (-5758978476775341977) = huge positive
candidate := len(dict.dict) - repeat + s // underflows to negative
load32(dict.dict, candidate) // OOB via unsafe.Pointer
load32 calls le.Load32 which uses unsafe.Pointer arithmetic without bounds checking:
func Load32[I Indexer](b []byte, i I) uint32 {
return *(*uint32)(unsafe.Add(unsafe.Pointer(unsafe.SliceData(b)), i))
}
This causes a segmentation fault (SIGSEGV) when the negative index is dereferenced.
PoC
package main
import (
"encoding/binary"
"fmt"
"github.com/klauspost/compress/s2"
)
func main() {
var dictData []byte
buf := make([]byte, binary.MaxVarintLen64)
n := binary.PutUvarint(buf, 12687765596934209639) // > MaxInt64
dictData = append(dictData, buf[:n]...)
dictData = append(dictData, make([]byte, 16)...) // minimum dict size
dict := s2.NewDict(dictData)
// dict is non-nil despite invalid repeat value (overflow bypassed validation)
src := make([]byte, 64)
for i := range src { src[i] = byte(i) }
dict.Encode(nil, src) // SIGSEGV: OOB access via unsafe.Pointer
}
Impact
- Denial of Service: The process crashes immediately with SIGSEGV
Attack Vector
Any application that:
1. Accepts user-supplied S2 dictionary data via s2.NewDict()
2. Calls Dict.Encode() on any data ≥32 bytes
Suggested Fix
Validate the uvarint value before converting to int:
if r > math.MaxInt64 {
return nil
}
d.repeat = int(r)
Or use uint for the repeat field and validate against uint(len(dict)).
References
- Source:
s2/dict.golines 59-61 (vulnerability),s2/encode_all.goline 947 (crash site) - Commit: 539243b (v1.18.6 + 4 commits)
Credits
Christopher Linke / https://github.com/celinke97/
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.18.6"
},
"package": {
"ecosystem": "Go",
"name": "github.com/klauspost/compress"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.18.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-63209"
],
"database_specific": {
"cwe_ids": [
"CWE-190",
"CWE-787"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-20T14:33:33Z",
"nvd_published_at": "2026-09-29T15:17:27Z",
"severity": "HIGH"
},
"details": "# Signed Integer Overflow in s2.NewDict\n\n## Summary\n\nA signed integer overflow vulnerability in `s2.NewDict()` allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding `MaxInt64`. When `Dict.Encode()` is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via `unsafe.Pointer` arithmetic, crashing the process with SIGSEGV.\n\n## Package\n\n- **Name:** `github.com/klauspost/compress/s2`\n- **Ecosystem:** Go\n- **Affected versions:** \u003c= v1.18.6 (all versions with `NewDict` function)\n\n## Severity\n\n**High (7.5)** \u2014 CVSS v3.1: `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`\n\n## Vulnerability\n\n### Type\n- CWE-190: Integer Overflow or Wraparound\n- CWE-787: Out-of-bounds Write (via unsafe.Pointer)\n\n### Description\n\nThe `NewDict()` function reads a uvarint from dictionary data and converts it to `int`:\n\n```go\nr, n := binary.Uvarint(dict)\n// ...\nd.repeat = int(r)\nif d.repeat \u003e len(dict) {\n return nil\n}\n```\n\nWhen `r` exceeds `MaxInt64` (9223372036854775807), `int(r)` overflows to a negative value. Since a negative number is never greater than a positive length, the validation check is bypassed.\n\nWhen `Dict.Encode()` is called, the negative `repeat` value causes an integer overflow in `encodeBlockDictGo()`:\n\n```go\nrepeat := len(dict.dict) - dict.repeat // overflows: 62 - (-5758978476775341977) = huge positive\ncandidate := len(dict.dict) - repeat + s // underflows to negative\nload32(dict.dict, candidate) // OOB via unsafe.Pointer\n```\n\n`load32` calls `le.Load32` which uses `unsafe.Pointer` arithmetic without bounds checking:\n\n```go\nfunc Load32[I Indexer](b []byte, i I) uint32 {\n return *(*uint32)(unsafe.Add(unsafe.Pointer(unsafe.SliceData(b)), i))\n}\n```\n\nThis causes a segmentation fault (SIGSEGV) when the negative index is dereferenced.\n\n## PoC\n\n```go\npackage main\n\nimport (\n \"encoding/binary\"\n \"fmt\"\n \"github.com/klauspost/compress/s2\"\n)\n\nfunc main() {\n var dictData []byte\n buf := make([]byte, binary.MaxVarintLen64)\n n := binary.PutUvarint(buf, 12687765596934209639) // \u003e MaxInt64\n dictData = append(dictData, buf[:n]...)\n dictData = append(dictData, make([]byte, 16)...) // minimum dict size\n\n dict := s2.NewDict(dictData)\n // dict is non-nil despite invalid repeat value (overflow bypassed validation)\n\n src := make([]byte, 64)\n for i := range src { src[i] = byte(i) }\n dict.Encode(nil, src) // SIGSEGV: OOB access via unsafe.Pointer\n}\n```\n\n## Impact\n\n- **Denial of Service:** The process crashes immediately with SIGSEGV\n\n## Attack Vector\n\nAny application that:\n1. Accepts user-supplied S2 dictionary data via `s2.NewDict()`\n2. Calls `Dict.Encode()` on any data \u226532 bytes\n\n## Suggested Fix\n\nValidate the uvarint value before converting to int:\n\n```go\nif r \u003e math.MaxInt64 {\n return nil\n}\nd.repeat = int(r)\n```\n\nOr use `uint` for the repeat field and validate against `uint(len(dict))`.\n\n## References\n\n- Source: `s2/dict.go` lines 59-61 (vulnerability), `s2/encode_all.go` line 947 (crash site)\n- Commit: 539243b (v1.18.6 + 4 commits)\n\n## Credits\nChristopher Linke / https://github.com/celinke97/",
"id": "GHSA-259r-337f-4rfw",
"modified": "2026-10-20T14:33:33Z",
"published": "2026-10-20T14:33:33Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63209"
},
{
"type": "WEB",
"url": "https://github.com/klauspost/compress/pull/1163"
},
{
"type": "WEB",
"url": "https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536"
},
{
"type": "WEB",
"url": "https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa"
},
{
"type": "PACKAGE",
"url": "https://github.com/klauspost/compress"
},
{
"type": "WEB",
"url": "https://github.com/klauspost/compress/releases/tag/v1.18.7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress"
}
GHSA-25PH-29M7-X9XV
Vulnerability from github – Published: 2022-05-13 01:01 – Updated: 2022-05-13 01:01An exploitable integer overflow exists in the 'multires_load_old_dm' functionality of the Blender open-source 3d creation suite v2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open a .blend file in order to trigger this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2017-12100"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-04-24T19:29:00Z",
"severity": "HIGH"
},
"details": "An exploitable integer overflow exists in the \u0027multires_load_old_dm\u0027 functionality of the Blender open-source 3d creation suite v2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open a .blend file in order to trigger this vulnerability.",
"id": "GHSA-25ph-29m7-x9xv",
"modified": "2022-05-13T01:01:39Z",
"published": "2022-05-13T01:01:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12100"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/08/msg00011.html"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2018/dsa-4248"
},
{
"type": "WEB",
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0452"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-25PX-QWQC-5CG6
Vulnerability from github – Published: 2025-06-10 21:31 – Updated: 2025-06-10 21:31InCopy versions 20.2, 19.5.3 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
{
"affected": [],
"aliases": [
"CVE-2025-30327"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-10T19:15:29Z",
"severity": "HIGH"
},
"details": "InCopy versions 20.2, 19.5.3 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
"id": "GHSA-25px-qwqc-5cg6",
"modified": "2025-06-10T21:31:22Z",
"published": "2025-06-10T21:31:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30327"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/incopy/apsb25-41.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-25V6-4VQG-8444
Vulnerability from github – Published: 2026-08-11 18:31 – Updated: 2026-08-11 18:31Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
{
"affected": [],
"aliases": [
"CVE-2026-70329"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-11T17:19:10Z",
"severity": "HIGH"
},
"details": "Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.",
"id": "GHSA-25v6-4vqg-8444",
"modified": "2026-08-11T18:31:49Z",
"published": "2026-08-11T18:31:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70329"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70329"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-263M-WCMP-R5J6
Vulnerability from github – Published: 2024-11-14 21:32 – Updated: 2025-12-23 18:30A local user can bypass the OpenAFS PAG (Process Authentication Group) throttling mechanism in Unix clients, allowing the user to create a PAG using an existing id number, effectively joining the PAG and letting the user steal the credentials in that PAG.
{
"affected": [],
"aliases": [
"CVE-2024-10394"
],
"database_specific": {
"cwe_ids": [
"CWE-190",
"CWE-305"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-14T20:15:20Z",
"severity": "HIGH"
},
"details": "A local user can bypass the OpenAFS PAG (Process Authentication Group)\nthrottling mechanism in Unix clients, allowing the user to create a PAG using\nan existing id number, effectively joining the PAG and letting the user steal\nthe credentials in that PAG.",
"id": "GHSA-263m-wcmp-r5j6",
"modified": "2025-12-23T18:30:19Z",
"published": "2024-11-14T21:32:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10394"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00019.html"
},
{
"type": "WEB",
"url": "https://openafs.org/pages/security/OPENAFS-SA-2024-001.txt"
},
{
"type": "WEB",
"url": "https://www.openafs.org/pages/security/OPENAFS-SA-2024-001.txt"
},
{
"type": "WEB",
"url": "https://www.openafs.org/security"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Ensure that all protocols are strictly defined, such that all out-of-bounds behavior can be identified simply, and require strict conformance to the protocol.
Mitigation MIT-3
Strategy: Language Selection
- Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- If possible, choose a language or compiler that performs automatic bounds checking.
Mitigation MIT-4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
- Use libraries or frameworks that make it easier to handle numbers without unexpected consequences.
- Examples include safe integer handling packages such as SafeInt (C++) or IntegerLib (C or C++). [REF-106]
Mitigation MIT-8
Strategy: Input Validation
- Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.
- Use unsigned integers where possible. This makes it easier to perform validation for integer overflows. When signed integers are required, ensure that the range check includes minimum values as well as maximum values.
Mitigation MIT-36
- Understand the programming language's underlying representation and how it interacts with numeric calculation (CWE-681). Pay close attention to byte size discrepancies, precision, signed/unsigned distinctions, truncation, conversion and casting between types, "not-a-number" calculations, and how the language handles numbers that are too large or too small for its underlying representation. [REF-7]
- Also be careful to account for 32-bit, 64-bit, and other potential differences that may affect the numeric representation.
Mitigation MIT-15
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Mitigation MIT-26
Strategy: Compilation or Build Hardening
Examine compiler warnings closely and eliminate problems with potential security implications, such as signed / unsigned mismatch in memory operations, or use of uninitialized variables. Even if the weakness is rarely exploitable, a single failure may lead to the compromise of the entire system.
CAPEC-92: Forced Integer Overflow
This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can execute arbitrary code.