CWE-191
Integer Underflow (Wrap or Wraparound)
Description
The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
Hierarchy (View 1000)
Parents
Children
none
CVEs mapped to this weakness (529)
page 15 of 27| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-6258 | Med | 0.44 | 6.8 | 0.00 | Sep 13, 2024 | BT: Missing length checks of net_buf in rfcomm_handle_data | ||
| CVE-2024-38517 | Hig | 0.44 | 7.8 | 0.00 | Jul 9, 2024 | Tencent RapidJSON is vulnerable to privilege escalation due to an integer underflow in the `GenericReader::ParseNumber()` function of `include/rapidjson/reader.h` when parsing JSON text from a stream. An attacker needs to send the victim a crafted file which needs to be opened;… | ||
| CVE-2024-3077 | Med | 0.44 | 6.8 | 0.00 | Mar 29, 2024 | An malicious BLE device can crash BLE victim device by sending malformed gatt packet | ||
| CVE-2024-0565 | Med | 0.44 | 6.8 | 0.02 | Jan 15, 2024 | An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy length, leading to a denial of service. | ||
| CVE-2022-30787 | Med | 0.44 | 6.7 | 0.00 | May 26, 2022 | An integer underflow in fuse_lib_readdir enables arbitrary memory read operations in NTFS-3G through 2021.8.22 when using libfuse-lite. | ||
| CVE-2014-9626 | Hig | 0.44 | 7.8 | 0.01 | Jan 24, 2020 | Integer underflow in the MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a box size less than 7. | ||
| CVE-2016-10268 | Hig | 0.44 | 7.8 | 0.02 | Mar 24, 2017 | tools/tiffcp.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (integer underflow and heap-based buffer under-read) or possibly have unspecified other impact via a crafted TIFF image, related to "READ of size 78490" and libtiff/tif_unix.c:115:23. | ||
| CVE-2026-73433 | Med | 0.43 | 6.6 | 0.00 | Aug 12, 2026 | A flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd chunk, gst_avi_demux_parse_strd() decrements a remaining-length counter by fixed offsets (98 and 10 bytes) without verifying sufficient data remains. For crafted strd… | ||
| CVE-2022-20073 | Med | 0.43 | 6.6 | 0.00 | Apr 11, 2022 | In preloader (usb), there is a possible out of bounds write due to a integer underflow. This could lead to local escalation of privilege, for an attacker who has physical access to the device, with no additional execution privileges needed. User interaction is needed for… | ||
| CVE-2017-14997 | Med | 0.43 | 6.5 | 0.03 | Oct 4, 2017 | GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (excessive memory allocation) because of an integer underflow in ReadPICTImage in coders/pict.c. | ||
| CVE-2026-18728 | Med | 0.42 | 6.5 | 0.00 | Aug 13, 2026 | A flaw was found in open-iscsi. An integer underflow vulnerability in the `iscsiuio` component, specifically during IPv4 Dynamic Host Configuration Protocol (DHCP) parsing, allows a remote attacker on the same local network segment to cause a denial of service. By sending a… | ||
| CVE-2026-18727 | Med | 0.42 | 6.5 | 0.00 | Aug 12, 2026 | A flaw was found in open-iscsi's iscsiuio component. This vulnerability involves an integer underflow and out-of-bounds read during Dynamic Host Configuration Protocol for IPv6 (DHCPv6) packet parsing. Specifically, crafted DHCPv6 Advertise traffic with a short User Datagram… | ||
| CVE-2026-62814 | Med | 0.42 | 6.5 | 0.01 | Aug 11, 2026 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. | ||
| CVE-2026-62745 | Med | 0.42 | 6.5 | 0.00 | Aug 11, 2026 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. | ||
| CVE-2026-62742 | Med | 0.42 | 6.5 | 0.00 | Aug 11, 2026 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. | ||
| CVE-2026-62720 | Med | 0.42 | 6.5 | 0.00 | Aug 11, 2026 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. | ||
| CVE-2026-62718 | Med | 0.42 | 6.5 | 0.00 | Aug 11, 2026 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. | ||
| CVE-2026-62716 | Med | 0.42 | 6.5 | 0.00 | Aug 11, 2026 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. | ||
| CVE-2026-62715 | Med | 0.42 | 6.5 | 0.00 | Aug 11, 2026 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. | ||
| CVE-2026-62714 | Med | 0.42 | 6.5 | 0.00 | Aug 11, 2026 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. |
- risk 0.44cvss 6.8epss 0.00
BT: Missing length checks of net_buf in rfcomm_handle_data
- risk 0.44cvss 7.8epss 0.00
Tencent RapidJSON is vulnerable to privilege escalation due to an integer underflow in the `GenericReader::ParseNumber()` function of `include/rapidjson/reader.h` when parsing JSON text from a stream. An attacker needs to send the victim a crafted file which needs to be opened;…
- risk 0.44cvss 6.8epss 0.00
An malicious BLE device can crash BLE victim device by sending malformed gatt packet
- risk 0.44cvss 6.8epss 0.02
An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy length, leading to a denial of service.
- risk 0.44cvss 6.7epss 0.00
An integer underflow in fuse_lib_readdir enables arbitrary memory read operations in NTFS-3G through 2021.8.22 when using libfuse-lite.
- risk 0.44cvss 7.8epss 0.01
Integer underflow in the MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a box size less than 7.
- risk 0.44cvss 7.8epss 0.02
tools/tiffcp.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (integer underflow and heap-based buffer under-read) or possibly have unspecified other impact via a crafted TIFF image, related to "READ of size 78490" and libtiff/tif_unix.c:115:23.
- risk 0.43cvss 6.6epss 0.00
A flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd chunk, gst_avi_demux_parse_strd() decrements a remaining-length counter by fixed offsets (98 and 10 bytes) without verifying sufficient data remains. For crafted strd…
- risk 0.43cvss 6.6epss 0.00
In preloader (usb), there is a possible out of bounds write due to a integer underflow. This could lead to local escalation of privilege, for an attacker who has physical access to the device, with no additional execution privileges needed. User interaction is needed for…
- risk 0.43cvss 6.5epss 0.03
GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (excessive memory allocation) because of an integer underflow in ReadPICTImage in coders/pict.c.
- risk 0.42cvss 6.5epss 0.00
A flaw was found in open-iscsi. An integer underflow vulnerability in the `iscsiuio` component, specifically during IPv4 Dynamic Host Configuration Protocol (DHCP) parsing, allows a remote attacker on the same local network segment to cause a denial of service. By sending a…
- risk 0.42cvss 6.5epss 0.00
A flaw was found in open-iscsi's iscsiuio component. This vulnerability involves an integer underflow and out-of-bounds read during Dynamic Host Configuration Protocol for IPv6 (DHCPv6) packet parsing. Specifically, crafted DHCPv6 Advertise traffic with a short User Datagram…
- risk 0.42cvss 6.5epss 0.01
Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network.
- risk 0.42cvss 6.5epss 0.00
Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network.
- risk 0.42cvss 6.5epss 0.00
Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network.
- risk 0.42cvss 6.5epss 0.00
Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network.
- risk 0.42cvss 6.5epss 0.00
Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network.
- risk 0.42cvss 6.5epss 0.00
Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network.
- risk 0.42cvss 6.5epss 0.00
Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network.
- risk 0.42cvss 6.5epss 0.00
Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network.