CWE-191

676 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 3 of them as exploited in the wild.

Critical 74High 373Medium 205Low 23Not scored 1

CVEs per yearBy the year they were published

CVE-2014-0497
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on…
Product not named
ExploitedHigh8.8
CVE-2022-0185
A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the…
kernel
ExploitedHigh8.4
CVE-2021-31956
Windows NTFS Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1809
ExploitedHigh7.8

CVE-2026-123571
Hickory DNS from 0.26.0 before 0.26.2 Panic via TSIG RDATA Decoding
hickory-dns · hickory-dns
High8.7
CVE-2026-80303
Avast WFP stream parser integer underflow causes system crash
Gen Digital · Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate
Not scored
CVE-2026-116788
FreeSWITCH: Pre-authentication heap buffer overflow in core XML empty-entity decoding
signalwire · freeswitch
High8.2
CVE-2026-116569
FreeSWITCH: Pre-authentication out-of-bounds write in MSRP message body parsing
signalwire · freeswitch
High7.5
CVE-2026-116568
FreeSWITCH: Out-of-bounds read in mod_rtmp H.264 video message parsing
signalwire · freeswitch
High7.5
CVE-2026-115928
FreeSWITCH: Stack buffer overflow parsing the SDP a=crypto key material on inbound calls
signalwire · freeswitch
High7.5
CVE-2026-122992
In G4KLX DStarGateway and F4FXL DStarGateway before 7b75de6, dstarCallsignToAPRS in APRSUtils.cpp has an integer underflow via an empty RS-MS1A sender field.
G4KLX · DStarGateway
Critical9.2
CVE-2026-121727
Kore before 4.3.0 Integer Underflow Memory Exhaustion via http_header_recv()
jorisvink · kore
High8.7
CVE-2026-61497
TinyUSB < 0.20.1 Integer Underflow via HID Report Descriptor Parser
hathach · TinyUSB
Medium5.2
CVE-2026-120060
psqlODBC does not validate server-supplied counts and lengths
PostgreSQL · psqlODBC
Medium5.9