CWE-681: Incorrect Conversion between Numeric Types
BaseLikelihood of exploit: High
When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
Consequences
- Other, Integrity: Unexpected State, Quality Degradation
How to prevent it
- Implementation: Avoid making conversion between numeric types. Always check for the allowed ranges.
Recent advisories
- GHSA-pjxj-pchx-4c3m — ImageMagick: Heap Buffer Over-Read in XCF decoder due to integer conversion overflow
- GHSA-5jv2-g5wq-cmr4 — vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving
- GHSA-m9w2-8782-2946 — Wasmtime has host data leakage with 64-bit tables and Winch
- GHSA-7355-pwx2-pm84 — ImageMagick: Integer overflow or wraparound and incorrect conversion between numeric types in the internal SVG decoder
- GHSA-93mf-426m-g6x9 — CoreDNS: DNS Cache Pinning via etcd Lease ID Confusion
- GHSA-ppx5-q359-pvwj — vyper's range(start, start + N) reverts for negative numbers
- GHSA-xrqm-fpgr-6hhx — Overflow/crash in `tf.range`
- GHSA-vmjw-c2vp-p33c — Crash in NMS ops caused by integer conversion to unsigned
- GHSA-g8wg-cjwc-xhhp — Heap OOB in nested `tf.map_fn` with `RaggedTensor`s
- GHSA-h6jh-7gv5-28vg — Bad alloc in `StringNGrams` caused by integer conversion
- GHSA-gf88-j2mg-cc82 — Crash caused by integer conversion to unsigned
- GHSA-9w2p-5mgw-p94c — Integer overflow due to conversion to unsigned
- GHSA-g4h2-gqm3-c9wq — Segfault in tf.raw_ops.ImmutableConst
- GHSA-844w-j86r-4x2j — Heap buffer overflow in `UnsortedSegmentSum` in TensorFlow
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor