| Impact | Details |
|---|---|
|
Modify Memory; DoS: Crash, Exit, or Restart; Execute Unauthorized Code or Commands |
Scope: Integrity, Availability, Confidentiality |
| Nature | Type | ID | Name |
|---|---|---|---|
| StartsWith | BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 190 | Integer Overflow or Wraparound |
| FollowedBy | ClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 119 | Improper Restriction of Operations within the Bounds of a Memory Buffer |
| Nature | Type | ID | Name |
|---|---|---|---|
| ChildOf | Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 190 | Integer Overflow or Wraparound |
Class: Not Language-Specific (Undetermined Prevalence)
Example 1
The following image processing code allocates a table for images.
This code intends to allocate a table of size num_imgs, however as num_imgs grows large, the calculation determining the size of the list will eventually overflow (CWE-190). This will result in a very small list to be allocated instead. If the subsequent code operates on the list as if it were num_imgs long, it may result in many types of out-of-bounds problems (CWE-119).
Note: this is a curated list of examples for users to understand the variety of ways in which this weakness can be introduced. It is not a complete list of all CVEs that are related to this CWE entry.
| Reference | Description |
|---|---|
| Nature | Type | ID | Name |
|---|---|---|---|
| MemberOf | CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic. | 1158 | SEI CERT C Coding Standard - Guidelines 04. Integers (INT) |
| MemberOf | CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic. | 1162 | SEI CERT C Coding Standard - Guidelines 08. Memory Management (MEM) |
| MemberOf | CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic. | 1399 | Comprehensive Categorization: Memory Safety |
Rationale
This CWE entry is a named chain, which combines multiple weaknesses.Comments
Mapping to each separate weakness in the chain would be more precise.| Mapped Taxonomy Name | Node ID | Fit | Mapped Node Name |
|---|---|---|---|
| CERT C Secure Coding | INT30-C | Imprecise | Ensure that unsigned integer operations do not wrap |
| CERT C Secure Coding | INT32-C | Imprecise | Ensure that operations on signed integers do not result in overflow |
| CERT C Secure Coding | MEM35-C | CWE More Abstract | Allocate sufficient memory for an object |
| CAPEC-ID | Attack Pattern Name |
|---|---|
| CAPEC-10 | Buffer Overflow via Environment Variables |
| CAPEC-100 | Overflow Buffers |
| CAPEC-14 | Client-side Injection-induced Buffer Overflow |
| CAPEC-24 | Filter Failure through Buffer Overflow |
| CAPEC-45 | Buffer Overflow via Symbolic Links |
| CAPEC-46 | Overflow Variables and Tags |
| CAPEC-47 | Buffer Overflow via Parameter Expansion |
| CAPEC-67 | String Format Overflow in syslog() |
| CAPEC-8 | Buffer Overflow in an API Call |
| CAPEC-9 | Buffer Overflow in Local Command-Line Utilities |
| CAPEC-92 | Forced Integer Overflow |
| Submissions | ||
|---|---|---|
| Submission Date | Submitter | Organization |
|
2008年04月11日
(CWE Draft 9, 2008年04月11日) |
CWE Content Team | MITRE |
| Modifications | ||
| Modification Date | Modifier | Organization |
|
2025年09月09日
(CWE 4.18, 2025年09月09日) |
CWE Content Team | MITRE |
| updated Affected_Resources, Functional_Areas | ||
|
2024年02月29日
(CWE 4.14, 2024年02月29日) |
CWE Content Team | MITRE |
| updated Demonstrative_Examples, Observed_Examples | ||
| 2023年06月29日 | CWE Content Team | MITRE |
| updated Mapping_Notes, Relationships | ||
| 2023年04月27日 | CWE Content Team | MITRE |
| updated Relationships | ||
| 2019年01月03日 | CWE Content Team | MITRE |
| updated Relationships | ||
| 2017年11月08日 | CWE Content Team | MITRE |
| updated Applicable_Platforms, Observed_Examples, Relationships, Relevant_Properties, Taxonomy_Mappings | ||
| 2017年01月19日 | CWE Content Team | MITRE |
| updated Relationships | ||
| 2011年06月01日 | CWE Content Team | MITRE |
| updated Common_Consequences | ||
| 2009年03月10日 | CWE Content Team | MITRE |
| updated Related_Attack_Patterns | ||
| 2008年09月08日 | CWE Content Team | MITRE |
| updated Relationships | ||
| 2008年07月01日 | Eric Dalci | Cigital |
| updated Time_of_Introduction | ||
Use of the Common Weakness Enumeration (CWE™) and the associated references from this website are subject to the Terms of Use. CWE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and managed by the Homeland Security Systems Engineering and Development Institute (HSSEDI) which is operated by The MITRE Corporation (MITRE). Copyright © 2006–2025, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation.