CWE-190: Integer Overflow or Wraparound
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
1,232 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2026-21385 — Integer Overflow or Wraparound in Graphics
- CVE-2026-87643 — Integer overflow in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to potentially e
- CVE-2026-17726 — Integer overflow in WebGL in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially pe
- CVE-2026-17717 — Integer overflow in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a san
- CVE-2026-17682 — Integer overflow in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the rend
- CVE-2026-17673 — Integer overflow in QUIC in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the rende
- CVE-2026-24814 — A integer overflow in swoole/swoole-src
- CVE-2025-14308 — Integer Overflow in Robocode's Buffer Write Method
- CVE-2025-64721 — Sandboxie's Integer Overflow in SbieIniServer::RC4Crypt allows sandbox escape and SYSTEM compromise
- CVE-2026-17705 — Integer overflow in libxml in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code i
- CVE-2026-79223 — Integer overflow in Chromium in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory inside the
- CVE-2026-79215 — Integer overflow in WebGL in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbit
- CVE-2026-78950 — Integer overflow in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbi
- CVE-2026-24830 — Integer Overflow or Wraparound in IronOS
- CVE-2025-53518 — An integer overflow vulnerability exists in the ABF parsing functionality of The Biosig Project libbiosig 3.9.0 and Mast
- CVE-2025-52581 — An integer overflow vulnerability exists in the GDF parsing functionality of The Biosig Project libbiosig 3.9.0 and Mast
- CVE-2024-32039 — FreeRDP Integer overflow & OutOfBound Write in clear_decompress_residual_data
- CVE-2024-27304 — pgx SQL Injection via Protocol Message Size Overflow
- CVE-2024-1917 — Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU
- CVE-2024-1916 — Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU
Recently published
- CVE-2026-87823 — zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size Methods
- CVE-2026-56711 — VLC media player 3.0.0 through 3.0.23 Heap Out-of-Bounds Write via Integer Overflow in Picture Allocation
- CVE-2026-87643 — Integer overflow in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to potentially e
- CVE-2026-87630 — Integer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the s
- CVE-2026-81987 — Acrobat Reader | Integer Overflow or Wraparound (CWE-190)
- CVE-2026-75771 — Photoshop Desktop | Integer Overflow or Wraparound (CWE-190)
- CVE-2026-75862 — Photoshop Desktop | Integer Overflow or Wraparound (CWE-190)
- CVE-2026-82007 — Photoshop Desktop | Integer Overflow or Wraparound (CWE-190)
- CVE-2026-75863 — Photoshop Desktop | Integer Overflow or Wraparound (CWE-190)
- CVE-2026-82076 — Integer Overflow in Query Planner Leads to Unbounded Memory Allocation and Denial of Service in MongoDB Server
- CVE-2026-86289 — Ollama GGUF Decoder gguf.go readGGUFV1String integer overflow
- CVE-2026-84732 — Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a d
- CVE-2026-86314 — Integer overflow in the source-bounds check in Memory::init() (src/runtime/Memory.cpp) in Samsung walrus on all platform
- CVE-2026-86139 — In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.
- CVE-2026-86138 — In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.
- CVE-2026-18078 — IBM i is Affected By Denial of Service Vulnerability in Save Restore []
- CVE-2026-81666 — Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems
- CVE-2026-85438 — MOOS-IvP through 24.8.1 Out-of-Bounds Write via Unvalidated IvP Payload Counts
- CVE-2026-48486 — Signum Node: Integer overflow in SMART_FEES fee distribution allows arbitrary miner reward inflation
- CVE-2026-84965 — Heap write primitive via size round-up wrap during JSON parsing on 32-bit builds
More specific weaknesses
- CWE-680 — Integer Overflow to Buffer Overflow