Numeric Truncation Error
CWE-197
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.
We track 18 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.1. 1 has been exploited in real attacks.
How this weakness is prevented
- Implementation: Ensure that no casts, implicit or explicit, take place that move from a larger size primitive or a smaller size primitive.
Latest Numeric Truncation Error vulnerabilities
- 7.5 High severity
NetVault Backup: Numeric Truncation Error
Quest NetVault Backup StnzCreateKey Numeric Truncation Error Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Quest NetVault Backup. Authentication is not required
- 9.6 Critical severity
FortiOS: Numeric Truncation Error
A numeric truncation error vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow a configured ibgp neighbor to send malicious/malformed attributes to all connect
- 7.0 High severity
FFmpeg: Numeric Truncation Error
FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in the PSD decoder in libavcodec/psd.c that allows attackers to corrupt heap memory on 32-bit builds by supplying a crafted PSD image. Attackers can choose dimensions and channel counts whose p
- 9.9 Critical severity
wasmtime: Numeric Truncation Error
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with man
- 8.8 High severity
FreeRTOS-Kernel: Out-of-bounds Read
Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port might allow, under certain conditions, an unprivileged task on MPU-enabled builds to read or w
- 7.0 High severity
Telegram: Numeric Truncation Error
Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Telegram. User interaction is required to exploit this vulnerability in that the target m
- 7.5 High severity
Junos OS: Numeric Truncation Error
A Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a BGP Prefix-SID route advertisement that is subsequently re-adverti
- 7.5 High severity
Red Hat Enterprise Linux 10: Numeric Truncation Error
The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer
- 7.5 High severity
BIND 9: Numeric Truncation Error
If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts. This issue affects BIND 9 versi
- 9.6 Critical severity
Chrome: Numeric Truncation Error
Numeric truncation error in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- 7.5 High severity
Open1722: Numeric Truncation Error
COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a
- 7.5 High severity
wolfSSL: Out-of-bounds Write
A heap buffer overflow could occur in the DTLS 1.3 ACK serialization path before the connecting peer is authenticated. The buffer overflow was due to an integer truncation when computing the length of the ACK record-number list, causing an undersized buffer to
- 7.5 High severity
Unbound: Numeric Truncation Error
NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet. The relevant options ('nsid', 'answer-cookie', 'p
- 7.7 High severity
SQLite: Numeric Truncation Error
There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.
- 8.8 High severity
DAP-1360: Numeric Truncation Error
D-Link DAP-1360 webupg UPGCGI_CheckAuth Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1360 routers. Authentication is not required
- 9.8 Critical severity
Fortinet FortiOS Heap-Based Buffer Overflow Exploited
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote un
- 7.8 High severity
vGPU software (guest driver) - Linux, vGPU…: Out-of-bounds Read
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an out-of-bounds read may lead to denial of service, information disclosure, or data tampering.
- 7.8 High severity
vGPU software (guest driver) - Linux, vGPU…: Incorrect Conversion between Numeric Types
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an unprivileged regular user can cause truncation errors when casting a primitive to a primitive of smaller size causes data to be lost in the conversion, whic