The product uses a signed primitive and performs a cast to an unsigned primitive, which can produce an unexpected value if the value of the signed primitive can not be represented using an unsigned primitive.
Volume of CVEs assigned to CWE-195 and their average CVSS base score over time.
Top CVEs that have been assigned this CWE. A single CVE can have multiple CWE assignments, though many have just one.
20 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-43663CRITICAL An integer conversion vulnerability exists in the SORBAx64.dll RecvPacket functionality of WellinTech KingHistorian 35.01.00.05. A specially crafted network packet can lead to a bu | Mar 20, 2023 | 9.8 | 37 | NO | NO |
CVE-2026-49840CRITICAL FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardwar | Jun 9, 2026 | 9.1 | 35 | NO | NO |
CVE-2026-55991MEDIUM In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion (if compiled with assertions on) and terminate the entire | Jul 22, 2026 | 5.9 | 29 | NO | NO |
CVE-2020-6096HIGH An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc imp | Apr 1, 2020 | 8.1 | 28 | NO | NO |
CVE-2011-3045HIGH Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.83 and other products, allows remote atta | Mar 22, 2012 | 8.8 | 28 | NO | NO |
CVE-2026-41682MEDIUM pupnp is an SDK for development of UPnP device and control point applications. Prior to version 1.18.5, pupnp is vulnerable to SRRF port confusion due to port truncation via atoi() | May 8, 2026 | 6.9 | 27 | NO | NO |
CVE-2016-6560HIGH illumos osnet-incorporation bcopy() and bzero() implementations make signed instead of unsigned comparisons allowing a system crash. | Mar 31, 2017 | 8.6 | 27 | NO | NO |
CVE-2025-65495HIGH Integer signedness error in tls_verify_call_back() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted TLS certificate th | Nov 24, 2025 | 7.5 | 25 | NO | NO |
CVE-2025-52566HIGH llama.cpp is an inference of several LLM models in C/C++. Prior to version b5721, there is a signed vs. unsigned integer overflow in llama.cpp's tokenizer implementation (llama_voc | Jun 24, 2025 | 8.8 | 24 | NO | NO |
CVE-2025-49847HIGH llama.cpp is an inference of several LLM models in C/C++. Prior to version b5662, an attacker‐supplied GGUF model vocabulary can trigger a buffer overflow in llama.cpp’s vocabulary | Jun 17, 2025 | 8.8 | 24 | NO | NO |
Exploit activity across CVEs assigned to this CWE, including CVEs that carry other CWE assignments.
Social posts that mention CVE IDs assigned to this CWE. This is assigned-CVE activity, not mentions of the CWE label itself.
Media articles that mention CVE IDs assigned to this CWE. This is assigned-CVE coverage, not mentions of the CWE label itself.