Common Weakness Enumeration
CWE-191
AllowedInteger Underflow (Wrap or Wraparound)
Abstraction: Base · Status: Draft
The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
727 vulnerabilities reference this CWE, most recent first.
GHSA-VMR3-XRH5-2R29
Vulnerability from github – Published: 2024-07-01 15:32 – Updated: 2024-07-01 15:32
VLAI
Details
Information disclosure while parsing sub-IE length during new IE generation.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-21466"
],
"database_specific": {
"cwe_ids": [
"CWE-191"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-01T15:15:15Z",
"severity": "MODERATE"
},
"details": "Information disclosure while parsing sub-IE length during new IE generation.",
"id": "GHSA-vmr3-xrh5-2r29",
"modified": "2024-07-01T15:32:44Z",
"published": "2024-07-01T15:32:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21466"
},
{
"type": "WEB",
"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2024-bulletin.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-VP3J-RHGW-HR9F
Vulnerability from github – Published: 2022-05-13 01:04 – Updated: 2022-05-13 01:04
VLAI
Details
Integer underflow in the xTrapezoidValid macro in render/picture.h in X.Org allows context-dependent attackers to cause a denial of service (crash) via a negative bottom value.
{
"affected": [],
"aliases": [
"CVE-2013-6424"
],
"database_specific": {
"cwe_ids": [
"CWE-191"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-01-18T19:55:00Z",
"severity": "MODERATE"
},
"details": "Integer underflow in the xTrapezoidValid macro in render/picture.h in X.Org allows context-dependent attackers to cause a denial of service (crash) via a negative bottom value.",
"id": "GHSA-vp3j-rhgw-hr9f",
"modified": "2022-05-13T01:04:23Z",
"published": "2022-05-13T01:04:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6424"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2013:1868"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2013-6424"
},
{
"type": "WEB",
"url": "https://bugs.freedesktop.org/show_bug.cgi?id=67484"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/ubuntu/+source/xorg-server/+bug/1197921"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1037984"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201701-64"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201710-30"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2013-12/msg00127.html"
},
{
"type": "WEB",
"url": "http://lists.x.org/archives/xorg-devel/2013-October/037996.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1868.html"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2013/dsa-2822"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2013/12/03/8"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2013/12/04/8"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2500-1"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-VQ3C-WGC6-RVMQ
Vulnerability from github – Published: 2026-07-14 00:31 – Updated: 2026-07-14 18:31
VLAI
Details
OpENer 2.3.0 (master branch up to commit 76b95cf) is vulnerable to a severe memory corruption issue caused by an integer underflow in the processing of connected explicit messages (SendUnitData).
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2026-51540"
],
"database_specific": {
"cwe_ids": [
"CWE-191"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-13T22:16:47Z",
"severity": "CRITICAL"
},
"details": "OpENer 2.3.0 (master branch up to commit 76b95cf) is vulnerable to a severe memory corruption issue caused by an integer underflow in the processing of connected explicit messages (SendUnitData).",
"id": "GHSA-vq3c-wgc6-rvmq",
"modified": "2026-07-14T18:31:51Z",
"published": "2026-07-14T00:31:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-51540"
},
{
"type": "WEB",
"url": "https://github.com/EIPStackGroup/OpENer/issues/568"
},
{
"type": "WEB",
"url": "https://gist.github.com/MrAlaskan/5e0c2af7f4a1d188814c7fa8f812c8da"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-VQGR-F24J-7RXX
Vulnerability from github – Published: 2022-05-13 01:25 – Updated: 2022-05-13 01:25
VLAI
Details
Integer underflow in the ksba_oid_to_str function in Libksba before 1.3.2, as used in GnuPG, allows remote attackers to cause a denial of service (crash) via a crafted OID in a (1) S/MIME message or (2) ECC based OpenPGP data, which triggers a buffer overflow.
{
"affected": [],
"aliases": [
"CVE-2014-9087"
],
"database_specific": {
"cwe_ids": [
"CWE-191"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-12-01T15:59:00Z",
"severity": "HIGH"
},
"details": "Integer underflow in the ksba_oid_to_str function in Libksba before 1.3.2, as used in GnuPG, allows remote attackers to cause a denial of service (crash) via a crafted OID in a (1) S/MIME message or (2) ECC based OpenPGP data, which triggers a buffer overflow.",
"id": "GHSA-vqgr-f24j-7rxx",
"modified": "2022-05-13T01:25:22Z",
"published": "2022-05-13T01:25:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-9087"
},
{
"type": "WEB",
"url": "https://blog.fuzzing-project.org/2-Buffer-overflow-and-other-minor-issues-in-GnuPG-and-libksba-TFPA-0012014.html"
},
{
"type": "WEB",
"url": "http://advisories.mageia.org/MGASA-2014-0498.html"
},
{
"type": "WEB",
"url": "http://lists.gnupg.org/pipermail/gnupg-announce/2014q4/000359.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/60073"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/60189"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/60233"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2014/dsa-3078"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:234"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:151"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/71285"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2427-1"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-VVVV-2V7H-W64M
Vulnerability from github – Published: 2025-11-11 18:30 – Updated: 2025-11-11 18:30
VLAI
Details
Illustrator on iPad versions 3.0.9 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2025-61826"
],
"database_specific": {
"cwe_ids": [
"CWE-191"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-11T18:15:42Z",
"severity": "HIGH"
},
"details": "Illustrator on iPad versions 3.0.9 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
"id": "GHSA-vvvv-2v7h-w64m",
"modified": "2025-11-11T18:30:22Z",
"published": "2025-11-11T18:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61826"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/illustrator-mobile-ios/apsb25-111.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-VWHR-CXJH-7VPW
Vulnerability from github – Published: 2022-05-24 19:01 – Updated: 2022-05-24 19:01
VLAI
Details
An integer underflow was discovered in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, improper validation of the PortID TLV leads to Denial of Service via a crafted lldp packet.
{
"affected": [],
"aliases": [
"CVE-2021-25849"
],
"database_specific": {
"cwe_ids": [
"CWE-191"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-05-10T11:15:00Z",
"severity": "HIGH"
},
"details": "An integer underflow was discovered in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, improper validation of the PortID TLV leads to Denial of Service via a crafted lldp packet.",
"id": "GHSA-vwhr-cxjh-7vpw",
"modified": "2022-05-24T19:01:56Z",
"published": "2022-05-24T19:01:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25849"
},
{
"type": "WEB",
"url": "https://www.moxa.com/en"
},
{
"type": "WEB",
"url": "https://www.moxa.com/en/support/product-support/security-advisory/vport-06ec-2v-series-ip-cameras-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-VXMF-93XR-M54G
Vulnerability from github – Published: 2024-08-13 18:31 – Updated: 2024-08-13 18:31
VLAI
Details
Windows TCP/IP Remote Code Execution Vulnerability
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2024-38063"
],
"database_specific": {
"cwe_ids": [
"CWE-191"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-13T18:15:10Z",
"severity": "CRITICAL"
},
"details": "Windows TCP/IP Remote Code Execution Vulnerability",
"id": "GHSA-vxmf-93xr-m54g",
"modified": "2024-08-13T18:31:15Z",
"published": "2024-08-13T18:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38063"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38063"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W2H7-QR22-RW7J
Vulnerability from github – Published: 2026-04-29 18:31 – Updated: 2026-04-29 18:31
VLAI
Details
Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoDB server. This issue affects all MongoDB Server v8.2 versions, all MongoDB Server v8.1 versions, MongoDB Server v8.0 versions prior to 8.0.21, MongoDB Server v7.0 versions prior to 7.0.32
Severity
{
"affected": [],
"aliases": [
"CVE-2026-6914"
],
"database_specific": {
"cwe_ids": [
"CWE-191"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-29T17:16:41Z",
"severity": "HIGH"
},
"details": "Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoDB server.\nThis issue affects all MongoDB Server v8.2 versions, all MongoDB Server v8.1 versions, MongoDB Server v8.0 versions prior to 8.0.21, MongoDB Server v7.0 versions prior to 7.0.32",
"id": "GHSA-w2h7-qr22-rw7j",
"modified": "2026-04-29T18:31:35Z",
"published": "2026-04-29T18:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6914"
},
{
"type": "WEB",
"url": "https://jira.mongodb.org/browse/SERVER-119981"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-W2WV-47Q4-8CFP
Vulnerability from github – Published: 2026-02-13 06:30 – Updated: 2026-03-02 18:31
VLAI
Details
A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. If affected product receive maliciously crafted packets, a DoS attack may cause Vnet/IP communication functions to stop or arbitrary programs to be executed. The affected products and versions are as follows: Vnet/IP Interface Package (for CENTUM VP R6 VP6C3300, CENTUM VP R7 VP7C3300) R1.07.00 or earlier
Severity
{
"affected": [],
"aliases": [
"CVE-2025-1924"
],
"database_specific": {
"cwe_ids": [
"CWE-191"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-13T05:16:02Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation.\nIf affected product receive maliciously crafted packets, a DoS attack may cause Vnet/IP communication functions to stop or arbitrary programs to be executed.\nThe affected products and versions are as follows: Vnet/IP Interface Package (for CENTUM VP R6 VP6C3300, CENTUM VP R7 VP7C3300) R1.07.00 or earlier",
"id": "GHSA-w2wv-47q4-8cfp",
"modified": "2026-03-02T18:31:38Z",
"published": "2026-02-13T06:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1924"
},
{
"type": "WEB",
"url": "https://web-material3.yokogawa.com/1/39281/files/YSAR-26-0002-E.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-W3XW-RQ95-8JCW
Vulnerability from github – Published: 2022-05-17 01:59 – Updated: 2022-05-17 01:59
VLAI
Details
Integer underflow in Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 might allow remote peers to cause a denial of service or possibly obtain sensitive information from memory or execute arbitrary code via a crafted message.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2015-2311"
],
"database_specific": {
"cwe_ids": [
"CWE-191"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-08-09T18:29:00Z",
"severity": "CRITICAL"
},
"details": "Integer underflow in Sandstorm Cap\u0027n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 might allow remote peers to cause a denial of service or possibly obtain sensitive information from memory or execute arbitrary code via a crafted message.",
"id": "GHSA-w3xw-rq95-8jcw",
"modified": "2022-05-17T01:59:31Z",
"published": "2022-05-17T01:59:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2311"
},
{
"type": "WEB",
"url": "https://github.com/capnproto/capnproto/commit/26bcceda72372211063d62aab7e45665faa83633"
},
{
"type": "WEB",
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=780566"
},
{
"type": "WEB",
"url": "https://github.com/capnproto/capnproto/blob/master/security-advisories/2015-03-02-1-c%2B%2B-integer-underflow.md"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2015/03/17/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.