Advisories · Weakness
CWE-195.
Every Advisory and CVE whose sources give the weakness CWE-195, newest first.
- CVSS 6.2 Medium
ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute
- Memory corruption
- CWE-195
>=1.4.0, <1.22.0 · fixed in 1.22.0
GHSA-m4pr-6v3c-6fgr · CVE-2026-115921 - CVSS 6.5 Medium
Arm Keil MDK-Middleware 8.3.0 may allow out-of-bounds reads and writes to the FTP Server RX Buffer
- Keil MDK-Middleware
- CWE-195
- CVSS 5.3 Medium
Keil MDK-Middleware: Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow pre-authentication out-of-bounds read in…
- Keil MDK-Middleware
- CWE-195
- CVSS 6.5 Medium
Out-of-Bounds Read via Unchecked Length Values
- RT-Labs AB SOEM
- Memory corruption
- Information disclosure
- CVSS 8.3 High
Memory Corruption via Integer Underflow in Message Length Validation
- RT-Labs AB SOEM
- Memory corruption
- CWE-195
- CVSS 7.1 High
Junos OS: SRX Series: An attacker causes data-plane denial of service when chassis-cluster high availability is used
- Juniper Networks Junos OS
- CWE-195
- CVSS 2.5 Low
godotengine Godot Engine: Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader…
- godotengine Godot Engine
- CWE-195
- CVSS 8.7 High
MLS membership checks compare a uint32 leaf_index as signed, admitting an out-of-range sender
- Legion of the Bouncy Castle Inc. BC-JAVA
- CWE-195
- CVSS 8.8 High
U-Boot before 2026.10-rc5 Buffer Overflow via NFS READLINK
- u-boot
- CWE-195
- CVSS 8.8 High
U-Boot before 2026.10-rc5 Buffer Overflow via NFS READ Reply
- u-boot
- CWE-195
- CVSS 7.1 High
MobilityDB through 1.3.0 Out-of-bounds Read DoS via WKB Deserialization
- MobilityDB
- CWE-195
- CVSS 8.2 High
RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration
- CWE-195
<1.13.0 · fixed in 1.13.0
GHSA-rm6m-hrcw-jw33 · CVE-2026-77406 - CVSS 6.8 Medium
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software TCP DNS Denial of Service Vulnerability
- Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
- Cisco Secure Firewall Threat Defense (FTD) Software
- CWE-195
- CVSS 8.7 High
MOOS core-moos through 10.4.0 MOOSDB Denial of Service via Negative Serialized String Length
- themoos core-moos
- CWE-195
- CVSS 6.9 Medium
Integer Conversion Vulnerability Resulting in an Out of Bounds Read in NI LabVIEW
- NI LabVIEW
- CWE-195
- CVSS 8.2 High
Coturn: Pre-authentication heap memory disclosure in ACME redirect (`try_acme_redirect`)
- coturn
- Memory corruption
- CWE-195
- CVSS 5.1 Medium
Heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoder
- Erlang OTP
- Memory corruption
- CWE-195
- CVSS 5.9 Medium
Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2
- NLnet Labs Unbound
- CWE-195
- CVSS 9.1 CriticalCritical · CVSS 9+
FreeSWITCH: Pre-authentication heap buffer overflow in libesl `Content-Length` parsing
- signalwire freeswitch
- Memory corruption
- CWE-20
- CVSS 6.9 Medium
pupnp: Port truncation via atoi() cast in parse_uri() allows SSRF port confusion
- pupnp
- Server-side request forgery (SSRF)
- CWE-195
- CVSS 6.5 Medium
OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp
- CWE-195
>=3.3.0, <3.3.7 || >=3.4.0, <3.4.5 · fixed in 3.3.7, 3.4.5
GHSA-q6vj-wxvf-5m8c · CVE-2026-26981 - CVSS 5.3 Medium
Sequoia PGP has Subtraction Overflow when aes_key_unwrap function is provided ciphertext that is too short
- CWE-195
<2.1.0 · fixed in 2.1.0
GHSA-v6x3-9r38-r27q · CVE-2025-67897 - CVSS 7.5 High
Integer signedness error in tls_verify_call_back() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted TLS certificate that causes i2d_X509(…
- CWE-195
- CVSS 8.6 High
llama.cpp tokenizer signed vs. unsigned heap overflow
- ggml-org llama.cpp
- Memory corruption
- CWE-195
- CVSS 8.8 High
llama.cpp Vulnerable to Buffer Overflow via Malicious GGUF Model
- ggml-org llama.cpp
- Memory corruption
- CWE-195
- CVSS 7.1 High
Junos OS and Junos OS Evolved: Receipt of a malformed LLDP TLV results in l2cpd crash
- Juniper Networks Junos OS
- Juniper Networks Junos OS Evolved
- CWE-195
- CVSS 4.4 Medium
Snowflake PHP PDO Driver has a Signed-to-Unsigned Conversion Error
- snowflakedb pdo_snowflake
- CWE-195
- CVSS 8.4 High
drivers/wlan/wlan_mgmt,c in RT-Thread through 5.0.2 has an integer signedness error and resultant buffer overflow.
- CWE-195
- CVSS 6.7 Medium
Dell BIOS contains a Signed to Unsigned Conversion Error vulnerability.
- Dell CPG BIOS
- CWE-195
- CVSS 7.8 High
Signed-to-unsigned conversion error in Audio
- Qualcomm, Inc. Snapdragon
- CWE-195
- CVSS 7.0 High
Potential signed to unsigned conversion errors and buffer overflow vulnerabilities in the Zephyr IPM driver
- Zephyr
- Memory corruption
- CWE-195
- CVSS 5.9 Medium
Okio Signed to Unsigned Conversion Error vulnerability
- CWE-195
- CWE-681
>=2.0.0-RC1, <3.4.0 || <1.17.6 · fixed in 3.4.0, 1.17.6
GHSA-w33c-445m-f8w7 · CVE-2023-3635 - CVSS 8.1 HighCritical · CVSS 7+ and EPSS
WellinTech KingHistorian: An integer conversion vulnerability exists in the SORBAx64.dll RecvPacket functionality…
- WellinTech KingHistorian
- CWE-195
- CVSS 8.1 High
Signed to Unsigned Conversion Error in Facebook Hermes
- CWE-195
- CWE-681
<0.5.2 · fixed in 0.5.2
GHSA-gmpm-xp43-f7g6 · CVE-2020-1913 - CVSS 8.1 High
GNU glibc: An exploitable signed comparison vulnerability exists in the ARMv7 memcpy()…
- GNU glibc
- CWE-195
-
illumos osnet-incorporation: illumos osnet-incorporation bcopy() and bzero() implementations make signed instead of…
- illumos osnet-incorporation
- CWE-195
- CVSS 8.8 High
Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.83 and other products, allows remote attackers to cause a de…
- CWE-195