CWE-195: Signed to Unsigned Conversion Error
The product uses a signed primitive and performs a cast to an unsigned primitive, which can produce an unexpected value if the value of the signed primitive can not be represented using an unsigned primitive.
21 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2025-49847 — llama.cpp Vulnerable to Buffer Overflow via Malicious GGUF Model
- CVE-2025-52566 — llama.cpp tokenizer signed vs. unsigned heap overflow
- CVE-2026-49840 — FreeSWITCH: Pre-authentication heap buffer overflow in libesl `Content-Length` parsing
- CVE-2026-85441 — MOOS core-moos through 10.4.0 MOOSDB Denial of Service via Negative Serialized String Length
- CVE-2025-30646 — Junos OS and Junos OS Evolved: Receipt of a malformed LLDP TLV results in l2cpd crash
- CVE-2026-62959 — Coturn: Pre-authentication heap memory disclosure in ACME redirect (`try_acme_redirect`)
- CVE-2026-41682 — pupnp: Port truncation via atoi() cast in parse_uri() allows SSRF port confusion
- CVE-2026-18444 — Integer Conversion Vulnerability Resulting in an Out of Bounds Read in NI LabVIEW
- CVE-2025-67897 — In Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short. A remote attacker can take adva
- CVE-2026-55991 — Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2
- CVE-2025-24792 — Snowflake PHP PDO Driver has a Signed-to-Unsigned Conversion Error
- CVE-2026-55737 — Heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoder
Recently published
- CVE-2026-85441 — MOOS core-moos through 10.4.0 MOOSDB Denial of Service via Negative Serialized String Length
- CVE-2026-18444 — Integer Conversion Vulnerability Resulting in an Out of Bounds Read in NI LabVIEW
- CVE-2026-62959 — Coturn: Pre-authentication heap memory disclosure in ACME redirect (`try_acme_redirect`)
- CVE-2026-55737 — Heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoder
- CVE-2026-55991 — Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2
- CVE-2026-49840 — FreeSWITCH: Pre-authentication heap buffer overflow in libesl `Content-Length` parsing
- CVE-2026-41682 — pupnp: Port truncation via atoi() cast in parse_uri() allows SSRF port confusion
- CVE-2025-67897 — In Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short. A remote attacker can take adva
- CVE-2025-52566 — llama.cpp tokenizer signed vs. unsigned heap overflow
- CVE-2025-49847 — llama.cpp Vulnerable to Buffer Overflow via Malicious GGUF Model
- CVE-2025-30646 — Junos OS and Junos OS Evolved: Receipt of a malformed LLDP TLV results in l2cpd crash
- CVE-2025-24792 — Snowflake PHP PDO Driver has a Signed-to-Unsigned Conversion Error