CWEweakness
CWE-681 Incorrect Conversion between Numeric Types
High
Official page ↗
- Abstraction
- Base
- Structure
- Simple
- Status
- Draft
- Likelihood of exploit
- High
- Languages
- C, Not Language-Specific, Python
- CWE version
- 5.0
Description
When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
Common consequences
• Other, Integrity: Unexpected State, Quality Degradation — The program could wind up using the wrong number and generate incorrect results. If the number is used to allocate resources or make a security decision, then this could introduce a vulnerability.
Potential mitigations
• [Implementation] Avoid making conversion between numeric types. Always check for the allowed ranges.
Detection methods
• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Observed examples
• CVE-2022-2639: Chain: integer coercion error (CWE-192) prevents a return value from indicating an error, leading to out-of-bounds write (CWE-787)
• CVE-2021-43537: Chain: in a web browser, an unsigned 64-bit integer is forcibly cast to a 32-bit integer (CWE-681) and potentially leading to an integer overflow (CWE-190). If an integer overflow occurs, this can cause heap memory corruption (CWE-122)
• CVE-2007-4268: Chain: integer signedness error (CWE-195) passes signed comparison, leading to heap overflow (CWE-122)
• CVE-2007-4988: Chain: signed short width value in image processor is sign extended during conversion to unsigned int, which leads to integer overflow and heap-based buffer overflow.
• CVE-2009-0231: Integer truncation of length value leads to heap-based buffer overflow.
• CVE-2008-3282: Size of a particular type changes for 64-bit platforms, leading to an integer truncation in document processor causes incorrect index to be generated.
Related
Observed example · CVE (6)
- CVE-2022-2639 An integer coercion error was found in the openvswitch kernel module. vulnerability
- CVE-2021-43537 An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt memory leading to a potentially… vulnerability
- CVE-2009-0231 The Embedded OpenType (EOT) Font Engine (T2EMBED.DLL) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and… vulnerability
- CVE-2008-3282 Integer overflow in the rtl_allocateMemory function in sal/rtl/source/alloc_global.c in the memory allocator in OpenOffice.org (OOo) 2.4.1,… vulnerability
- CVE-2007-4268 Integer signedness error in the Networking component in Apple Mac OS X 10.4 through 10.4.10 allows local users to execute arbitrary code… vulnerability
- CVE-2007-4988 Sign extension error in the ReadDIBImage function in ImageMagick before 6.3.5-9 allows context-dependent attackers to execute arbitrary… vulnerability
Can precede · CWE (1)
- CWE-682 Incorrect Calculation weakness
Child of · CWE (1)
- CWE-704 Incorrect Type Conversion or Cast weakness
Referenced by CVE · weakness (153)
- CVE-2026-114654 A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subtype value supplied… vulnerability
- CVE-2026-114118 Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint256 subtraction without first checking… vulnerability
- CVE-2026-12670 IBM MQ could allow an authenticated attacker to cause a denial of service through a specially crafted message that triggers excessive… vulnerability
- CVE-2026-83872 Incorrect conversion between numeric types in Windows TCP/IP allows an authorized attacker to elevate privileges locally. vulnerability
- CVE-2026-106432 The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. vulnerability
- CVE-2026-107224 Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. vulnerability
- CVE-2026-47508 NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an incorrect… vulnerability
- CVE-2026-47539 NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an incorrect… vulnerability
- CVE-2026-98049 In the Linux kernel, the following vulnerability has been resolved: bpf: zero extend the result of an arena 32-bit cmpxchg… vulnerability
- CVE-2026-98095 In the Linux kernel, the following vulnerability has been resolved: af_packet: Don't cast tpacket_hdr.tp_len to int in… vulnerability
- CVE-2026-98143 In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Don't read the U65 rounding mode as a storage mode Bits… vulnerability
- CVE-2026-88362 MuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsR_isindex() in jsrun.c. vulnerability
- CVE-2026-88366 NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__pathArcTo() when parsing SVG arc commands. vulnerability
- CVE-2026-88367 NanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__curveDivs() during SVG stroke rasterization. vulnerability
- CVE-2026-88368 NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in the rasterizer's nsvg__addActive() function. vulnerability
- CVE-2026-88387 LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::parse_tiff_ifd() when processing TIFF tag 0x00fe… vulnerability
- CVE-2026-77412 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. vulnerability
- CVE-2026-69438 Incorrect conversion between numeric types in Microsoft JScript allows an unauthorized attacker to execute code over a network. vulnerability
- CVE-2026-84963 An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text… vulnerability
- CVE-2026-84966 An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be… vulnerability
- CVE-2026-84970 A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. vulnerability
- CVE-2026-82522 libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary… vulnerability
- CVE-2026-82457 su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uid_t and gid_t, allowing… vulnerability
- CVE-2026-75145 FFmpeg before commit b4c199c contains an incorrect integer narrowing conversion in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). vulnerability
- CVE-2026-19879 A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. vulnerability
- CVE-2026-21069 Incorrect conversion between numeric types in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write… vulnerability
- CVE-2026-6426 A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. vulnerability
- CVE-2026-55768 GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. vulnerability
- CVE-2026-63926 In the Linux kernel, the following vulnerability has been resolved: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data When… vulnerability
- CVE-2026-50402 Incorrect conversion between numeric types in Windows NTFS allows an authorized attacker to elevate privileges locally. vulnerability