CWE-191
AllowedInteger Underflow (Wrap or Wraparound)
Abstraction: Base · Status: Draft
The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
886 vulnerabilities reference this CWE, most recent first.
GHSA-F7HF-M5CF-J6WV
Vulnerability from github – Published: 2026-10-14 18:32 – Updated: 2026-10-14 18:32libsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned sessions can send an AclSize below 8 in a QUERY_INFO reply, bypassing ACE bounds checks and crashing the client.
{
"affected": [],
"aliases": [
"CVE-2026-110714"
],
"database_specific": {
"cwe_ids": [
"CWE-191"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-14T16:17:43Z",
"severity": "HIGH"
},
"details": "libsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned sessions can send an AclSize below 8 in a QUERY_INFO reply, bypassing ACE bounds checks and crashing the client.",
"id": "GHSA-f7hf-m5cf-j6wv",
"modified": "2026-10-14T18:32:18Z",
"published": "2026-10-14T18:32:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110714"
},
{
"type": "WEB",
"url": "https://github.com/sahlberg/libsmb2/commit/523abe20be3207011a936db47f1d3bab79c05450"
},
{
"type": "WEB",
"url": "https://github.com/sahlberg/libsmb2"
},
{
"type": "WEB",
"url": "https://github.com/sahlberg/libsmb2/blob/d67e213a5c4e7e4969fd81f0b95e4ca5831fbba1/lib/smb2-data-security-descriptor.c#L266"
},
{
"type": "WEB",
"url": "https://hackmd.io/@haind-pwn/libsmb2-query-info-reply-oob-read"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/libsmb2-through-6.2-heap-out-of-bounds-read-via-decode-acl-integer-underflow"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-F7P3-6RHJ-P7JV
Vulnerability from github – Published: 2026-04-28 09:34 – Updated: 2026-04-28 09:34In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.
{
"affected": [],
"aliases": [
"CVE-2026-40356"
],
"database_specific": {
"cwe_ids": [
"CWE-191"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-28T07:16:03Z",
"severity": "MODERATE"
},
"details": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.",
"id": "GHSA-f7p3-6rhj-p7jv",
"modified": "2026-04-28T09:34:12Z",
"published": "2026-04-28T09:34:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40356"
},
{
"type": "WEB",
"url": "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f"
},
{
"type": "WEB",
"url": "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html"
},
{
"type": "WEB",
"url": "https://web.mit.edu/kerberos/advisories"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F935-QQ4F-PJ9F
Vulnerability from github – Published: 2021-12-20 00:00 – Updated: 2022-01-05 00:02Apache PLC4X - PLC4C (Only the C language implementation was effected) was vulnerable to an unsigned integer underflow flaw inside the tcp transport. Users should update to 0.9.1, which addresses this issue. However, in order to exploit this vulnerability, a user would have to actively connect to a mallicious device which could send a response with invalid content. Currently we consider the probability of this being exploited as quite minimal, however this could change in the future, especially with the industrial networks growing more and more together.
{
"affected": [],
"aliases": [
"CVE-2021-43083"
],
"database_specific": {
"cwe_ids": [
"CWE-191"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-19T09:15:00Z",
"severity": "HIGH"
},
"details": "Apache PLC4X - PLC4C (Only the C language implementation was effected) was vulnerable to an unsigned integer underflow flaw inside the tcp transport. Users should update to 0.9.1, which addresses this issue. However, in order to exploit this vulnerability, a user would have to actively connect to a mallicious device which could send a response with invalid content. Currently we consider the probability of this being exploited as quite minimal, however this could change in the future, especially with the industrial networks growing more and more together.",
"id": "GHSA-f935-qq4f-pj9f",
"modified": "2022-01-05T00:02:10Z",
"published": "2021-12-20T00:00:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43083"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/jxx6qc84z60xbbhn6vp2s5qf09psrtc7"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/12/20/2"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-F99C-R797-V657
Vulnerability from github – Published: 2024-09-18 09:30 – Updated: 2024-09-23 18:30In the Linux kernel, the following vulnerability has been resolved:
hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
DIV_ROUND_CLOSEST() after kstrtol() results in an underflow if a large negative number such as -9223372036854775808 is provided by the user. Fix it by reordering clamp_val() and DIV_ROUND_CLOSEST() operations.
{
"affected": [],
"aliases": [
"CVE-2024-46756"
],
"database_specific": {
"cwe_ids": [
"CWE-191"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-18T08:15:04Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (w83627ehf) Fix underflows seen when writing limit attributes\n\nDIV_ROUND_CLOSEST() after kstrtol() results in an underflow if a large\nnegative number such as -9223372036854775808 is provided by the user.\nFix it by reordering clamp_val() and DIV_ROUND_CLOSEST() operations.",
"id": "GHSA-f99c-r797-v657",
"modified": "2024-09-23T18:30:33Z",
"published": "2024-09-18T09:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46756"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/26825b62bd1bd3e53b4f44e0745cb516d5186343"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/56cfdeb2c77291f0b5e4592731adfb6ca8fc7c24"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5c1de37969b7bc0abcb20b86e91e70caebbd4f89"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/77ab0fd231c4ca873ec6908e761970360acc6df2"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8fecb75bff1b7d87a071c32a37aa0700f2be379d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/93cf73a7bfdce683bde3a7bb65f270d3bd24497b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/cc4be794c8d8c253770103e097ab9dbdb5f99ae1"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d92f0baf99a7e327dcceab37cce57c38aab1f691"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F9R8-4R5P-XQ44
Vulnerability from github – Published: 2022-05-14 00:57 – Updated: 2025-04-20 03:46GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (excessive memory allocation) because of an integer underflow in ReadPICTImage in coders/pict.c.
{
"affected": [],
"aliases": [
"CVE-2017-14997"
],
"database_specific": {
"cwe_ids": [
"CWE-191"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-10-04T01:29:00Z",
"severity": "HIGH"
},
"details": "GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (excessive memory allocation) because of an integer underflow in ReadPICTImage in coders/pict.c.",
"id": "GHSA-f9r8-4r5p-xq44",
"modified": "2025-04-20T03:46:19Z",
"published": "2022-05-14T00:57:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14997"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF62B5PJA2JDUOCKJGUQO3SPL74BEYSV"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WHIKB4TP6KBJWT2UIPWL5MWMG5QXKGEJ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PF62B5PJA2JDUOCKJGUQO3SPL74BEYSV"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WHIKB4TP6KBJWT2UIPWL5MWMG5QXKGEJ"
},
{
"type": "WEB",
"url": "https://sourceforge.net/p/graphicsmagick/bugs/511"
},
{
"type": "WEB",
"url": "https://sourceforge.net/p/graphicsmagick/code/ci/0683f8724200495059606c03f04e0d589b33ebe8"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4232-1"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2018/dsa-4321"
},
{
"type": "WEB",
"url": "http://hg.graphicsmagick.org/hg/GraphicsMagick?cmd=changeset%3Bnode=0683f8724200"
},
{
"type": "WEB",
"url": "http://hg.graphicsmagick.org/hg/GraphicsMagick?cmd=changeset;node=0683f8724200"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/101183"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F9WM-R4W7-HW29
Vulnerability from github – Published: 2026-10-13 03:30 – Updated: 2026-10-13 03:30SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful exploitation can therefore result in a high impact on the availability of the affected application. There is no impact on the confidentiality or integrity of the application.
{
"affected": [],
"aliases": [
"CVE-2026-58249"
],
"database_specific": {
"cwe_ids": [
"CWE-191"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-13T01:16:46Z",
"severity": "HIGH"
},
"details": "SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful exploitation can therefore result in a high impact on the availability of the affected application. There is no impact on the confidentiality or integrity of the application.",
"id": "GHSA-f9wm-r4w7-hw29",
"modified": "2026-10-13T03:30:29Z",
"published": "2026-10-13T03:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58249"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3765424"
},
{
"type": "WEB",
"url": "https://url.sap/sapsecuritypatchday"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FC22-5H8W-J83C
Vulnerability from github – Published: 2026-08-04 18:31 – Updated: 2026-08-04 18:31Information Disclosure when processing wireless network channel switch information with improperly formatted length fields.
{
"affected": [],
"aliases": [
"CVE-2026-24077"
],
"database_specific": {
"cwe_ids": [
"CWE-191"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-04T16:16:23Z",
"severity": "MODERATE"
},
"details": "Information Disclosure when processing wireless network channel switch information with improperly formatted length fields.",
"id": "GHSA-fc22-5h8w-j83c",
"modified": "2026-08-04T18:31:26Z",
"published": "2026-08-04T18:31:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24077"
},
{
"type": "WEB",
"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2026-bulletin.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FGFF-HW4C-VX3Q
Vulnerability from github – Published: 2026-10-09 21:31 – Updated: 2026-10-13 12:32OpENer v2.3/commit 76b95cf, contains an integer underflow in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a denial of service
{
"affected": [],
"aliases": [
"CVE-2026-75352"
],
"database_specific": {
"cwe_ids": [
"CWE-191"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-09T19:16:42Z",
"severity": "HIGH"
},
"details": "OpENer v2.3/commit 76b95cf, contains an integer underflow in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a denial of service",
"id": "GHSA-fgff-hw4c-vx3q",
"modified": "2026-10-13T12:32:51Z",
"published": "2026-10-09T21:31:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75352"
},
{
"type": "WEB",
"url": "https://github.com/EIPStackGroup/OpENer/issues/571"
},
{
"type": "WEB",
"url": "https://github.com/EIPStackGroup/OpENer"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FJ2R-4WRV-W3GP
Vulnerability from github – Published: 2022-05-24 16:46 – Updated: 2024-04-04 00:46Improper input validation on input data which is used to locate and copy the additional IEs in WLAN function can lead to potential integer truncation issue in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCS605, Qualcomm 215, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 675, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24, SM7150
{
"affected": [],
"aliases": [
"CVE-2018-11930"
],
"database_specific": {
"cwe_ids": [
"CWE-191"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-05-24T17:29:00Z",
"severity": "CRITICAL"
},
"details": "Improper input validation on input data which is used to locate and copy the additional IEs in WLAN function can lead to potential integer truncation issue in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCS605, Qualcomm 215, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 675, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24, SM7150",
"id": "GHSA-fj2r-4wrv-w3gp",
"modified": "2024-04-04T00:46:57Z",
"published": "2022-05-24T16:46:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11930"
},
{
"type": "WEB",
"url": "https://www.codeaurora.org/security-bulletin/2019/04/01/april-2019-code-aurora-security-bulletin"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FJ6H-5WVF-8FJ2
Vulnerability from github – Published: 2026-09-04 00:31 – Updated: 2026-09-04 00:31MOOS essential-moos through 10.0.1 contains a buffer overflow vulnerability in CMOOSUDPLink::ReadPktFromArray() that allows remote attackers to corrupt heap memory by sending UDP datagrams with negative declared lengths. Attackers can send crafted UDP packets to the configured UDPListen port to trigger an oversized memcpy operation that writes past the destination buffer, causing heap corruption and denial of service.
{
"affected": [],
"aliases": [
"CVE-2026-85436"
],
"database_specific": {
"cwe_ids": [
"CWE-191"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-03T23:17:22Z",
"severity": "HIGH"
},
"details": "MOOS essential-moos through 10.0.1 contains a buffer overflow vulnerability in CMOOSUDPLink::ReadPktFromArray() that allows remote attackers to corrupt heap memory by sending UDP datagrams with negative declared lengths. Attackers can send crafted UDP packets to the configured UDPListen port to trigger an oversized memcpy operation that writes past the destination buffer, causing heap corruption and denial of service.",
"id": "GHSA-fj6h-5wvf-8fj2",
"modified": "2026-09-04T00:31:08Z",
"published": "2026-09-04T00:31:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85436"
},
{
"type": "WEB",
"url": "https://github.com/themoos/essential-moos/pull/21"
},
{
"type": "WEB",
"url": "https://github.com/themoos/essential-moos/commit/613175fcf63fb9c6c5329c4ec57c2d18588b33e2"
},
{
"type": "WEB",
"url": "https://github.com/themoos/essential-moos"
},
{
"type": "WEB",
"url": "https://github.com/themoos/essential-moos/blob/b897ea86dba8b61412dc48ac0cfb5ff34cdaf5f6/Essentials/pMOOSBridge/MOOSUDPLink.cpp#L171"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/moos-essential-moos-through-10.0.1-pmoosbridge-heap-corruption-via-negative-udp-length"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.