Weaknesses of type CWE-195

22 results

Erro de conversão de inteiro com sinal para sem sinal

Ocorre quando um valor inteiro com sinal (que pode ser negativo) é convertido ou comparado com um tipo sem sinal, causando comportamento inesperado. Um número negativo, quando interpretado como sem sinal, vira um valor muito grande, podendo contornar validações ou causar alocações excessivas de memória.

Example

Um desenvolvedor valida se um `int` (com sinal) recebido do usuário é menor que 100 antes de alocar um buffer. Se o valor for -1, a comparação com 100 passa na validação, mas ao converter para `unsigned int` para usar em malloc(), -1 vira 4.294.967.295 bytes — causando falha ou overflow.

How to mitigate

Sempre validar o sinal antes de converter para tipo sem sinal; preferir manter cálculos em tipos com sinal quando possível; usar compiladores com avisos para conversões implícitas ativados (-Wsign-conversion no GCC/Clang); implementar validação explícita do intervalo de valores esperados.

CVE-2022-43663HIGHAn integer conversion vulnerability exists in the SORBAx64.dll RecvPacket functionality of WellinTech KingHistorian 35.01.00.05. A speciallyEPSS 14.0%CVE-2020-6096HIGHAn exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMvEPSS 5.2%CVE-2011-3045HIGHInteger signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.8EPSS 3.6%CVE-2016-6560—illumos osnet-incorporation bcopy() and bzero() implementations make signed instead of unsigned comparisons allowing a system crash.EPSS 1.7%CVE-2023-3635MEDIUMOkio GzipSource unhandled exception Denial of ServiceEPSS 1.3%CVE-2020-1913—An Integer signedness error in the JavaScript Interpreter in Facebook Hermes prior to commit 2c7af7ec481ceffd0d14ce2d7c045e475fd71dc6 allowsEPSS 1.2%CVE-2026-26981MEDIUMOpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cppEPSS 0.5%CVE-2025-49847HIGHllama.cpp Vulnerable to Buffer Overflow via Malicious GGUF ModelEPSS 0.4%CVE-2023-5184HIGHPotential signed to unsigned conversion errors and buffer overflow vulnerabilities in the Zephyr IPM driverEPSS 0.4%CVE-2026-62959HIGHCoturn: Pre-authentication heap memory disclosure in ACME redirect (`try_acme_redirect`)EPSS 0.4%CVE-2026-41682MEDIUMpupnp: Port truncation via atoi() cast in parse_uri() allows SSRF port confusionEPSS 0.3%CVE-2024-25388HIGHdrivers/wlan/wlan_mgmt,c in RT-Thread through 5.0.2 has an integer signedness error and resultant buffer overflow.EPSS 0.3%CVE-2025-52566HIGHllama.cpp tokenizer signed vs. unsigned heap overflowEPSS 0.3%CVE-2026-49840CRITICALFreeSWITCH: Pre-authentication heap buffer overflow in libesl `Content-Length` parsingEPSS 0.3%CVE-2025-67897MEDIUMIn Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue EPSS 0.3%CVE-2026-55991MEDIUMRemote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2EPSS 0.2%CVE-2025-30646HIGHJunos OS and Junos OS Evolved: Receipt of a malformed LLDP TLV results in l2cpd crashEPSS 0.2%CVE-2025-65495HIGHInteger signedness error in tls_verify_call_back() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of EPSS 0.2%CVE-2023-28063MEDIUM Dell BIOS contains a Signed to Unsigned Conversion Error vulnerability. A local authenticated malicious user with admin privileges could poEPSS 0.2%CVE-2026-55737MEDIUMHeap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoderEPSS 0.1%