CWE-197: Numeric Truncation Error

Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.

76 tracked CVEs are classified under this weakness.

Highest-risk vulnerabilities

• CVE-2026-87529 — Numeric truncation error in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execu
• CVE-2025-6965 — Integer Truncation on SQLite
• CVE-2026-6679 — DTLS 1.3 ACK serialization heap buffer overflow via integer truncation
• CVE-2026-42944 — Heap overflow with multiple NSID, COOKIE, PADDING EDNS options
• CVE-2026-73523 — COVESA Open1722 0.9.2 Stack Memory Disclosure via acf-can-listener.c Integer Truncation
• CVE-2026-32240 — Cap'n Proto: Integer overflow in KJ-HTTP chunk size
• CVE-2025-10543 — In Eclipse Paho Go MQTT v3.1 library (paho.mqtt.golang) versions <=1.5.0 UTF-8 encoded strings, passed into the library,
• CVE-2026-86315 — An out-of-bounds write caused by numeric truncation Samsung Open Source Escargot on Linux x86-64 allows an attacker who
• CVE-2026-6039 — Heap buffer overflow in DXF polyline import
• CVE-2026-77014 — Libsoup: libsoup: integer truncation in sort_ranges() comparator causes silent omission of http range responses
• CVE-2026-42371 — uriparser before 1.0.1 has numeric truncation in text range comparison, if an application accepts URIs with a length in
• CVE-2026-80213 — An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS label's length
• CVE-2026-44927 — In uriparser before 1.0.2, there is pointer difference truncation to int in various places.
• CVE-2026-65610 — Numeric Truncation Error in nnn
• CVE-2026-49263 — Capstone WASM `br_table` instruction-size truncation can cause no-progress disassembly and parser desynchronization

Recently published

• CVE-2026-87529 — Numeric truncation error in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execu
• CVE-2026-86315 — An out-of-bounds write caused by numeric truncation Samsung Open Source Escargot on Linux x86-64 allows an attacker who
• CVE-2026-80213 — An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS label's length
• CVE-2026-77014 — Libsoup: libsoup: integer truncation in sort_ranges() comparator causes silent omission of http range responses
• CVE-2026-65610 — Numeric Truncation Error in nnn
• CVE-2026-73523 — COVESA Open1722 0.9.2 Stack Memory Disclosure via acf-can-listener.c Integer Truncation
• CVE-2026-49263 — Capstone WASM `br_table` instruction-size truncation can cause no-progress disassembly and parser desynchronization
• CVE-2026-6679 — DTLS 1.3 ACK serialization heap buffer overflow via integer truncation
• CVE-2026-6039 — Heap buffer overflow in DXF polyline import
• CVE-2026-42944 — Heap overflow with multiple NSID, COOKIE, PADDING EDNS options
• CVE-2026-44927 — In uriparser before 1.0.2, there is pointer difference truncation to int in various places.
• CVE-2026-42371 — uriparser before 1.0.1 has numeric truncation in text range comparison, if an application accepts URIs with a length in
• CVE-2026-32240 — Cap'n Proto: Integer overflow in KJ-HTTP chunk size
• CVE-2025-10543 — In Eclipse Paho Go MQTT v3.1 library (paho.mqtt.golang) versions <=1.5.0 UTF-8 encoded strings, passed into the library,
• CVE-2025-6965 — Integer Truncation on SQLite

Browse the full CVE database