CWE-196
AllowedUnsigned to Signed Conversion Error
Abstraction: Variant · Status: Draft
The product uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value if the value of the unsigned primitive can not be represented using a signed primitive.
11 vulnerabilities reference this CWE, most recent first.
GHSA-MMCG-PW3P-CWJH
Vulnerability from github – Published: 2026-07-17 06:31 – Updated: 2026-07-17 06:31Unsigned to Signed Conversion Error (CWE-196) vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Project. When Tera Term attempts to establish an SSH connection to a server set up by an attacker, out-of-bounds read/write may occur. As a result, the contents of adjacent memory regions may be transmitted to the server, and Tera Term may behave unexpected or terminate abnormally.
{
"affected": [],
"aliases": [
"CVE-2026-58317"
],
"database_specific": {
"cwe_ids": [
"CWE-196"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-17T05:16:40Z",
"severity": "MODERATE"
},
"details": "Unsigned to Signed Conversion Error (CWE-196) vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Project. When Tera Term attempts to establish an SSH connection to a server set up by an attacker, out-of-bounds read/write may occur. As a result, the contents of adjacent memory regions may be transmitted to the server, and Tera Term may behave unexpected or terminate abnormally.",
"id": "GHSA-mmcg-pw3p-cwjh",
"modified": "2026-07-17T06:31:00Z",
"published": "2026-07-17T06:31:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58317"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN65294474"
},
{
"type": "WEB",
"url": "https://teratermproject.github.io/SA/JVN65294474-en.html"
},
{
"type": "WEB",
"url": "https://teratermproject.github.io/SA/JVN65294474.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Choose a language which is not subject to these casting flaws.
Mitigation
Design object accessor functions to implicitly check values for valid sizes. Ensure that all functions which will be used as a size are checked previous to use as a size. If the language permits, throw exceptions rather than using in-band errors.
Mitigation
Error check the return values of all functions. Be aware of implicit casts made, and use unsigned variables for sizes if at all possible.
CAPEC-92: Forced Integer Overflow
This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can execute arbitrary code.