Common Weakness Enumeration
CWE-195
AllowedSigned to Unsigned Conversion Error
Abstraction: Variant · Status: Draft
The product uses a signed primitive and performs a cast to an unsigned primitive, which can produce an unexpected value if the value of the signed primitive can not be represented using an unsigned primitive.
37 vulnerabilities reference this CWE, most recent first.
GHSA-V6X3-9R38-R27Q
Vulnerability from github – Published: 2025-12-14 06:30 – Updated: 2025-12-16 19:30
VLAI
Summary
Sequoia PGP has Subtraction Overflow when aes_key_unwrap function is provided ciphertext that is too short
Details
In Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue to crash an application by sending a victim an encrypted message with a crafted PKESK or SKESK packet.
Severity
5.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "sequoia-openpgp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-67897"
],
"database_specific": {
"cwe_ids": [
"CWE-195"
],
"github_reviewed": true,
"github_reviewed_at": "2025-12-16T19:30:41Z",
"nvd_published_at": "2025-12-14T05:16:06Z",
"severity": "MODERATE"
},
"details": "In Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue to crash an application by sending a victim an encrypted message with a crafted PKESK or SKESK packet.",
"id": "GHSA-v6x3-9r38-r27q",
"modified": "2025-12-16T19:30:41Z",
"published": "2025-12-14T06:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67897"
},
{
"type": "WEB",
"url": "https://bugs.debian.org/1122582"
},
{
"type": "PACKAGE",
"url": "https://gitlab.com/sequoia-pgp/sequoia"
},
{
"type": "WEB",
"url": "https://gitlab.com/sequoia-pgp/sequoia/-/blob/b59886e5e7bdf7169ed330f309a6633d131776e5/openpgp/NEWS#L7-L26"
},
{
"type": "WEB",
"url": "https://gitlab.com/sequoia-pgp/sequoia/-/commit/b59886e5e7bdf7169ed330f309a6633d131776e5"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2025-0136.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Sequoia PGP has Subtraction Overflow when aes_key_unwrap function is provided ciphertext that is too short"
}
GHSA-VR3H-29QC-JVJF
Vulnerability from github – Published: 2025-11-24 15:30 – Updated: 2025-11-24 15:30
VLAI
Details
Integer signedness error in tls_verify_call_back() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted TLS certificate that causes i2d_X509() to return -1 and be misused as a malloc() size parameter.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2025-65495"
],
"database_specific": {
"cwe_ids": [
"CWE-195"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-24T14:15:47Z",
"severity": "HIGH"
},
"details": "Integer signedness error in tls_verify_call_back() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted TLS certificate that causes i2d_X509() to return -1 and be misused as a malloc() size parameter.",
"id": "GHSA-vr3h-29qc-jvjf",
"modified": "2025-11-24T15:30:29Z",
"published": "2025-11-24T15:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65495"
},
{
"type": "WEB",
"url": "https://github.com/obgm/libcoap/issues/1744"
},
{
"type": "WEB",
"url": "https://github.com/obgm/libcoap/pull/1750"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W33C-445M-F8W7
Vulnerability from github – Published: 2023-07-12 21:30 – Updated: 2023-07-13 17:01
VLAI
Summary
Okio Signed to Unsigned Conversion Error vulnerability
Details
GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.
Severity
5.9 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.squareup.okio:okio"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0-RC1"
},
{
"fixed": "3.4.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.squareup.okio:okio"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.17.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.squareup.okio:okio-jvm"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0-RC1"
},
{
"fixed": "3.4.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-3635"
],
"database_specific": {
"cwe_ids": [
"CWE-195",
"CWE-681"
],
"github_reviewed": true,
"github_reviewed_at": "2023-07-13T17:01:48Z",
"nvd_published_at": "2023-07-12T19:15:08Z",
"severity": "MODERATE"
},
"details": "GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.\n\n",
"id": "GHSA-w33c-445m-f8w7",
"modified": "2023-07-13T17:01:48Z",
"published": "2023-07-12T21:30:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3635"
},
{
"type": "WEB",
"url": "https://github.com/square/okio/pull/1280"
},
{
"type": "WEB",
"url": "https://github.com/square/okio/pull/1334"
},
{
"type": "WEB",
"url": "https://github.com/square/okio/commit/81bce1a30af244550b0324597720e4799281da7b"
},
{
"type": "WEB",
"url": "https://github.com/square/okio/commit/b4fa875dc24950680c386e4b1c593660ce4f7839"
},
{
"type": "PACKAGE",
"url": "https://github.com/square/okio"
},
{
"type": "WEB",
"url": "https://github.com/square/okio/blob/master/CHANGELOG.md#version-1176"
},
{
"type": "WEB",
"url": "https://research.jfrog.com/vulnerabilities/okio-gzip-source-unhandled-exception-dos-xray-523195"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Okio Signed to Unsigned Conversion Error vulnerability"
}
GHSA-W4PV-VQP3-F753
Vulnerability from github – Published: 2022-05-13 01:27 – Updated: 2025-06-09 18:31
VLAI
Details
Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.83 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file, a different vulnerability than CVE-2011-3026.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2011-3045"
],
"database_specific": {
"cwe_ids": [
"CWE-190",
"CWE-195"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2012-03-22T16:55:00Z",
"severity": "MODERATE"
},
"details": "Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.83 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file, a different vulnerability than CVE-2011-3026.",
"id": "GHSA-w4pv-vqp3-f753",
"modified": "2025-06-09T18:31:54Z",
"published": "2022-05-13T01:27:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-3045"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=799000"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14763"
},
{
"type": "WEB",
"url": "http://code.google.com/p/chromium/issues/detail?id=116162"
},
{
"type": "WEB",
"url": "http://googlechromereleases.blogspot.com/2012/03/stable-channel-update_21.html"
},
{
"type": "WEB",
"url": "http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng%3Ba=commit%3Bh=a8c319a2b281af68f7ca0e2f9a28ca57b44ceb2b"
},
{
"type": "WEB",
"url": "http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng;a=commit;h=a8c319a2b281af68f7ca0e2f9a28ca57b44ceb2b"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075424.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075619.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075981.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075987.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076461.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076731.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00000.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2012-03/msg00051.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2012-0407.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2012-0488.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/48320"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/48485"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/48512"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/48554"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/49660"
},
{
"type": "WEB",
"url": "http://security.gentoo.org/glsa/glsa-201206-15.xml"
},
{
"type": "WEB",
"url": "http://src.chromium.org/viewvc/chrome?view=rev\u0026revision=125311"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2012/dsa-2439"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:033"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1026823"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WFGH-7J4X-4XJQ
Vulnerability from github – Published: 2026-09-04 00:31 – Updated: 2026-09-04 00:31
VLAI
Details
MOOS core-moos through 10.4.0 fails to validate that serialized string lengths are non-negative in CMOOSMsg::operator>>. Unauthenticated attackers can send a crafted message with a negative length value to the MOOSDB port, causing an unhandled exception that terminates the database process.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-85441"
],
"database_specific": {
"cwe_ids": [
"CWE-195"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-03T23:17:23Z",
"severity": "HIGH"
},
"details": "MOOS core-moos through 10.4.0 fails to validate that serialized string lengths are non-negative in CMOOSMsg::operator\u003e\u003e. Unauthenticated attackers can send a crafted message with a negative length value to the MOOSDB port, causing an unhandled exception that terminates the database process.",
"id": "GHSA-wfgh-7j4x-4xjq",
"modified": "2026-09-04T00:31:09Z",
"published": "2026-09-04T00:31:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85441"
},
{
"type": "WEB",
"url": "https://github.com/themoos/core-moos/pull/74"
},
{
"type": "WEB",
"url": "https://github.com/themoos/core-moos/commit/04c92981091fdaa2ff85e2ba7eff94f6288bdbaf"
},
{
"type": "WEB",
"url": "https://github.com/themoos/core-moos"
},
{
"type": "WEB",
"url": "https://github.com/themoos/core-moos/blob/ec9c77c68fcbdef8f5e4c60fe243acd223433f0c/Core/libMOOS/Comms/MOOSMsg.cpp#L453"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/moos-core-moos-through-10.4.0-moosdb-denial-of-service-via-negative-serialized-string-length"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-X379-72WQ-8VWF
Vulnerability from github – Published: 2024-02-06 09:31 – Updated: 2024-02-06 09:31
VLAI
Details
Dell BIOS contains a Signed to Unsigned Conversion Error vulnerability. A local authenticated malicious user with admin privileges could potentially exploit this vulnerability, leading to denial of service.
Severity
6.7 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-28063"
],
"database_specific": {
"cwe_ids": [
"CWE-195",
"CWE-681"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-06T08:15:46Z",
"severity": "MODERATE"
},
"details": "\nDell BIOS contains a Signed to Unsigned Conversion Error vulnerability. A local authenticated malicious user with admin privileges could potentially exploit this vulnerability, leading to denial of service.\n\n",
"id": "GHSA-x379-72wq-8vwf",
"modified": "2024-02-06T09:31:38Z",
"published": "2024-02-06T09:31:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28063"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000214780/dsa-2023-176-dell-client-bios-security-update-for-a-signed-to-unsigned-conversion-error-vulnerability"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XMHR-MV9M-HHVF
Vulnerability from github – Published: 2022-05-24 17:13 – Updated: 2022-05-24 17:13
VLAI
Details
An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data.
Severity
8.1 (High)
{
"affected": [],
"aliases": [
"CVE-2020-6096"
],
"database_specific": {
"cwe_ids": [
"CWE-191",
"CWE-195"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-04-01T22:15:00Z",
"severity": "HIGH"
},
"details": "An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the \u0027num\u0027 parameter results in a signed comparison vulnerability. If an attacker underflows the \u0027num\u0027 parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data.",
"id": "GHSA-xmhr-mv9m-hhvf",
"modified": "2022-05-24T17:13:19Z",
"published": "2022-05-24T17:13:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-6096"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPYXTDOOB4PQGTYAMZAZNJIB3FF6YQXI"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/URXOIA2LDUKHQXK4BE55BQBRI6ZZG3Y6"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202101-20"
},
{
"type": "WEB",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=25620"
},
{
"type": "WEB",
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1019"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.