CWEweakness

CWE-680 Integer Overflow to Buffer Overflow

Official page ↗
Abstraction
Compound
Structure
Chain
Status
Draft
Languages
C, C++, Memory-Unsafe
CWE version
5.0

Description

The product performs a calculation to determine how much memory to allocate, but an integer overflow can occur that causes less memory to be allocated than expected, leading to a buffer overflow.

Common consequences

• Integrity, Availability, Confidentiality: Modify Memory, DoS: Crash, Exit, or Restart, Execute Unauthorized Code or Commands

Detection methods

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.) • Automated Dynamic Analysis: Use tools that are integrated during compilation to insert runtime error-checking mechanisms related to memory safety errors, such as AddressSanitizer (ASan) for C/C++ [REF-1518].

Observed examples

• CVE-2021-43537: Chain: in a web browser, an unsigned 64-bit integer is forcibly cast to a 32-bit integer (CWE-681) and potentially leading to an integer overflow (CWE-190). If an integer overflow occurs, this can cause heap memory corruption (CWE-122) • CVE-2017-1000121: Chain: unchecked message size metadata allows integer overflow (CWE-190) leading to buffer overflow (CWE-119).

Related

Attack pattern · CAPEC (11)

  • CAPEC-10 Buffer Overflow via Environment Variables attack pattern
  • CAPEC-100 Overflow Buffers attack pattern
  • CAPEC-14 Client-side Injection-induced Buffer Overflow attack pattern
  • CAPEC-24 Filter Failure through Buffer Overflow attack pattern
  • CAPEC-45 Buffer Overflow via Symbolic Links attack pattern
  • CAPEC-46 Overflow Variables and Tags attack pattern
  • CAPEC-47 Buffer Overflow via Parameter Expansion attack pattern
  • CAPEC-67 String Format Overflow in syslog() attack pattern
  • CAPEC-8 Buffer Overflow in an API Call attack pattern
  • CAPEC-9 Buffer Overflow in Local Command-Line Utilities attack pattern
  • CAPEC-92 Forced Integer Overflow attack pattern

Observed example · CVE (2)

  • CVE-2021-43537 An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt memory leading to a potentially… vulnerability
  • CVE-2017-1000121 The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate message size metadata, allowing a… vulnerability

Child of · CWE (1)

  • CWE-190 Integer Overflow or Wraparound weakness

Starts with · CWE (1)

  • CWE-190 Integer Overflow or Wraparound weakness

Referenced by CAPEC · weakness (11)

  • CAPEC-10 Buffer Overflow via Environment Variables attack pattern
  • CAPEC-100 Overflow Buffers attack pattern
  • CAPEC-14 Client-side Injection-induced Buffer Overflow attack pattern
  • CAPEC-24 Filter Failure through Buffer Overflow attack pattern
  • CAPEC-45 Buffer Overflow via Symbolic Links attack pattern
  • CAPEC-46 Overflow Variables and Tags attack pattern
  • CAPEC-47 Buffer Overflow via Parameter Expansion attack pattern
  • CAPEC-67 String Format Overflow in syslog() attack pattern
  • CAPEC-8 Buffer Overflow in an API Call attack pattern
  • CAPEC-9 Buffer Overflow in Local Command-Line Utilities attack pattern
  • CAPEC-92 Forced Integer Overflow attack pattern

Referenced by CVE · weakness (114)

  • CVE-2026-91189 The GUIX binary resource loader never checks that a font page's glyph range is well formed. vulnerability
  • CVE-2026-95107 A ThreadX module chooses `object_size` when it calls `txm_module_object_allocate`. vulnerability
  • CVE-2026-76825 RestrictedPython is a tool that helps define a subset of the Python language for accepting program input in a trusted environment. vulnerability
  • CVE-2026-90783 MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib library's ODML superindex parser due to integer wraparound… vulnerability
  • CVE-2026-81647 Out-of-bounds read vulnerability in the graphics module. vulnerability
  • CVE-2026-19313 An heap overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary… vulnerability
  • CVE-2026-70651 libvips is a fast image processing library with low memory needs. vulnerability
  • CVE-2026-19588 Integer Overflow to Buffer Overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers. vulnerability
  • CVE-2026-43627 llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llama_batch_init() function where unchecked… vulnerability
  • CVE-2026-55200 libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper… vulnerability
  • CVE-2026-8376 Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling… vulnerability
  • CVE-2026-24928 Out-of-bounds write vulnerability in the file system module. vulnerability
  • CVE-2026-25541 Bytes is a utility library for working with bytes. vulnerability
  • CVE-2025-32468 A memory corruption vulnerability exists in the BMPv3 Image Decoding functionality of the SAIL Image Decoding Library v0.9.8. vulnerability
  • CVE-2025-46407 A memory corruption vulnerability exists in the BMPv3 Palette Decoding functionality of the SAIL Image Decoding Library v0.9.8. vulnerability
  • CVE-2025-52456 A memory corruption vulnerability exists in the WebP Image Decoding functionality of the SAIL Image Decoding Library v0.9.8. vulnerability
  • CVE-2025-52930 A memory corruption vulnerability exists in the BMPv3 RLE Decoding functionality of the SAIL Image Decoding Library v0.9.8. vulnerability
  • CVE-2025-53510 A memory corruption vulnerability exists in the PSD Image Decoding functionality of the SAIL Image Decoding Library v0.9.8. vulnerability
  • CVE-2025-20263 A vulnerability in the web services interface of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall… vulnerability
  • CVE-2025-54952 An integer overflow vulnerability in the loading of ExecuTorch models can cause smaller-than-expected memory regions to be allocated,… vulnerability
  • CVE-2025-23326 NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause an integer overflow through a… vulnerability
  • CVE-2025-54623 Out-of-bounds read vulnerability in the devicemanager module. vulnerability
  • CVE-2025-53630 llama.cpp is an inference of several LLM models in C/C++. vulnerability
  • CVE-2025-32023 Redis is an open source, in-memory database that persists on disk. vulnerability
  • CVE-2024-48877 A memory corruption vulnerability exists in the Shared String Table Record Parser implementation in xls2csv utility version 0.95. vulnerability
  • CVE-2024-58107 Buffer overflow vulnerability in the codec module Impact: Successful exploitation of this vulnerability may affect availability. vulnerability
  • CVE-2025-21442 Memory corruption while transmitting packet mapping information with invalid header payload size. vulnerability
  • CVE-2024-57956 Out-of-bounds read vulnerability in the interpreter string module Impact: Successful exploitation of this vulnerability may affect… vulnerability
  • CVE-2024-56451 Integer overflow vulnerability during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability may… vulnerability
  • CVE-2024-55626 Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. vulnerability
Show all 114 ›