CWE-194 Unexpected Sign Extension
variantThe product performs an operation on a number that causes it to be sign extended when it is transformed into a larger data type. When the original number is negative, this can produce unexpected values that lead to resultant weaknesses.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (12)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2015-8869US | critical9.1 | — | ||
OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sensitive information as demonstrated by a… | ||||
| CVE-2020-6075US | high8.8 | — | ||
An exploitable out-of-bounds write vulnerability exists in the store_data_buffer function of the igcore19d.dll library of Accusoft ImageGear 19.5.0. A specially crafted PNG file ca… | ||||
| CVE-2019-10044US | high8.8 | — | ||
Telegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android, iOS, and Linux, is vulnerable to an IDN homograph attack when displaying messages containing U… | ||||
| CVE-2018-10887US | high8.1 | — | ||
A flaw was found in libgit2 before version 0.27.3. It has been discovered that an unexpected sign extension in git_delta_apply function in delta.c file may lead to an integer overf… | ||||
| CVE-2020-13544US | high7.8 | — | ||
An exploitable sign extension vulnerability exists in the TextMaker document parsing functionality of SoftMaker Office 2021’s TextMaker application. A specially crafted document ca… | ||||
| CVE-2021-38434US | high7.8 | — | ||
FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project files, which could result in an unexpected sign extension.… | ||||
| CVE-2019-15237US | high7.4 | — | ||
Roundcube Webmail through 1.3.9 mishandles Punycode xn-- domain names, leading to homograph attacks. | ||||
| CVE-2022-32138US | medium6.5 | — | ||
In multiple CODESYS products, a remote attacker may craft a request which may cause an unexpected sign extension, resulting in a denial-of-service condition or memory overwrite. | ||||
| CVE-2022-47524US | medium5.4 | — | ||
F-Secure SAFE Browser 19.1 before 19.2 for Android allows an IDN homograph attack. | ||||
| CVE-2012-4010US | medium5.0 | — | ||
Opera before 11.60 allows remote attackers to spoof the address bar via unspecified homograph characters, a different vulnerability than CVE-2010-2660. | ||||
| CVE-2020-25779US | low3.3 | — | ||
Trend Micro Antivirus for Mac 2020 (Consumer) has a vulnerability in which a Internationalized Domain Name homograph attack (Puny-code) could be used to add a malicious website to… | ||||
| CVE-2025-13632US | — | — | ||
Inappropriate implementation in DevTools in Google Chrome prior to 143.0.7499.41 allowed an attacker who convinced a user to install a malicious extension to potentially perform a… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan