CWE-190: Integer Overflow vulnerabilities

Heap-based buffer overflow in Windows Cred SSProvider Protocol allows an authorized attacker to elevate privileges locally.

Integer Overflow or Wraparound vulnerability in dragonflydb dragonfly (src/redis/lua/struct modules). This vulnerability is associated with program files lua_struct.C. This issue affects dragonfly: 1.30.1, 1.30.0, 1.28.18.

Sony XAV-AX8500 Bluetooth Packet Handling Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Sony XAV-AX8500 devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The specific flaw exists within the handling of Bluetooth packets. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the elysian-bt-service process. Was ZDI-CAN-26283.

Sony XAV-AX8500 Bluetooth SDP Protocol Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sony XAV-AX8500 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the Bluetooth SDP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26288.

InCopy versions 20.2, 19.5.3 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Integer overflow or wraparound in Windows SMB allows an authorized attacker to elevate privileges locally.

A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4 content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within applications that process such archives using libarchive. This bug affects libarchive versions prior to 3.8.0.

GIMP ICO File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ICO files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26752.

An integer overflow vulnerability exists in the OLE Document File Allocation Table Parser functionality of catdoc 0.95. A specially crafted malformed file can lead to heap-based memory corruption. An attacker can provide a malicious file to trigger this vulnerability.

A low privileged attacker can set the date of the devices to the 19th of January 2038 an therefore exceed the 32-Bit time limit. This causes the date of the switch to be set back to January 1st, 1970.

CVE-2025-4945 is an integer overflow vulnerability in the cookie parsing logic of the libsoup HTTP library, affecting the handling of cookie expiration dates. This flaw allows specially crafted cookie expiration values to trigger an integer overflow, potentially bypassing cookie expiration checks and causing persistent or unintended cookie behavior. The vulnerability is rated with a low CVSS score of 3.7 and does not impact confidentiality or availability but may impact integrity. A security update addressing this issue is available from Red Hat for multiple Red Hat Enterprise Linux 9 variants.

CVE-2025-48175 is an integer overflow vulnerability in libavif versions before 1.3.0. The flaw exists in the avifImageRGBToYUV function within reformat.c, where multiplications involving rgbRowBytes, yRowBytes, uRowBytes, and vRowBytes can overflow. This may lead to incorrect calculations affecting image processing.

CVE-2025-48174 is an integer overflow vulnerability in libavif versions before 1.3.0. The flaw occurs in the makeRoom function in stream.c, where an integer overflow in the calculation of stream->offset plus size leads to a buffer overflow. This vulnerability can cause a loss of integrity and availability but does not impact confidentiality.

CVE-2025-2760 is a high-severity integer overflow vulnerability in GIMP version 2.10.38 affecting the parsing of XWD files. It allows remote attackers to execute arbitrary code if a user opens a malicious file or visits a malicious page. The flaw arises from improper validation of user-supplied data leading to an integer overflow before buffer allocation.

A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN.

A flaw was found in grub2. When reading data from a squash4 filesystem, grub's squash4 fs module uses user-controlled parameters from the filesystem geometry to determine the internal buffer size, however, it improperly checks for integer overflows. A maliciously crafted filesystem may lead some of those buffer size calculations to overflow, causing it to perform a grub_malloc() operation with a smaller size than expected. As a result, the direct_read() will perform a heap based out-of-bounds write during data reading. This flaw may be leveraged to corrupt grub's internal critical data and may result in arbitrary code execution, by-passing secure boot protections.

A stack overflow flaw was found when reading a BFS file system. A crafted BFS filesystem may lead to an uncontrolled loop, causing grub2 to crash.

An integer overflow flaw was found in the BFS file system driver in grub2. When reading a file with an indirect extent map, grub2 fails to validate the number of extent entries to be read. A crafted or corrupted BFS filesystem may cause an integer overflow during the file reading, leading to a heap of bounds read. As a consequence, sensitive data may be leaked, or grub2 will crash.

CVE-2024-52559 is a high-severity vulnerability in the Linux kernel's drm/msm/gem component. It involves an integer overflow in the msm_ioctl_gem_submit() function, where user-supplied 32-bit values for command size and offset could wrap around, potentially leading to memory corruption or other critical impacts. The issue has been addressed by adding checks to prevent integer wrapping using size_add().

Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted squashfs filesystem via sbrk, via request2size, or because ptrdiff_t is mishandled on x86_64.