目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-197 数值截断错误 类漏洞列表 68

CWE-197 数值截断错误 类弱点 68 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-197 数值截断错误属于数据转换漏洞，发生在将较大类型的数据强制转换为较小类型时，导致高位数据丢失。攻击者常利用此缺陷构造恶意输入，使截断后的值被用作缓冲区索引或循环迭代器，从而引发越界访问或逻辑绕过。开发者应避免隐式类型转换，在数据转换前进行严格的范围检查与验证，确保数值在目标类型的安全范围内，以消除潜在风险。

MITRE CWE 官方描述
CWE：CWE-197 Numeric Truncation Error（数值截断错误） 英文：当基本数据类型（primitive）被强制转换为较小尺寸的基本数据类型时，会发生截断错误（Truncation errors），导致在转换过程中数据丢失。 当基本数据类型被转换为较小的基本数据类型时，较大值的高位（high order bits）在转换过程中丢失，这可能导致产生一个不等于原始值的意外值。该值可能被用作缓冲区的索引、循环迭代器，或仅仅是必要的状态数据。在任何情况下，该值都不可信，系统将处于未定义状态。虽然此方法可能被用于有效地隔离值的低位（low bits），但这种用法较为罕见，而截断通常意味着发生了实现错误。
常见影响 (1)
Integrity Modify Memory
The true value of the data is lost and corrupted data is used.
缓解措施 (1)
Implementation Ensure that no casts, implicit or explicit, take place that move from a larger size primitive or a smaller size primitive.
代码示例 (2)
This example, while not exploitable, shows the possible mangling of values associated with truncation errors:
int intPrimitive; short shortPrimitive; intPrimitive = (int)(~((int)0) ^ (1 << (sizeof(int)*8-1))); shortPrimitive = intPrimitive; printf("Int MAXINT: %d\nShort MAXINT: %d\n", intPrimitive, shortPrimitive);
Bad · C
Int MAXINT: 2147483647 Short MAXINT: -1
Result
In the following Java example, the method updateSalesForProduct is part of a business application class that updates the sales information for a particular product. The method receives as arguments the product ID and the integer amount sold. The product ID is used to retrieve the total product count from an inventory object which returns the count as an integer. Before calling the method of the sa…
... // update sales database for number of product sold with product ID public void updateSalesForProduct(String productID, int amountSold) { // get the total number of products in inventory database int productCount = inventory.getProductCount(productID); // convert integer values to short, the method for the // sales object requires the parameters to be of type short short count = (short) productCount; short sold = (short) amountSold; // update sales database for product sales.updateSalesCount(productID, count, sold); } ...
Bad · Java
... // update sales database for number of product sold with product ID public void updateSalesForProduct(String productID, int amountSold) { // get the total number of products in inventory database int productCount = inventory.getProductCount(productID); // make sure that integer numbers are not greater than // maximum value for type short before converting if ((productCount < Short.MAX_VALUE) && (amountSold < Short.MAX_VALUE)) { // convert integer values to short, the method for the // sales object requires the parameters to be of type short short count = (short) productCount; short sold =
Good · Java
CVE ID 标题 CVSS 风险等级 Published
CVE-2026-63449 Suricata SIP大消息体帧关键字绕过漏洞 — suricata 3.7 Low 2026-09-18
CVE-2026-19667 bind 9.16.27 远程断言失败漏洞 — BIND 9 7.5 High 2026-09-16
CVE-2026-87529 Google Chrome 数字错误漏洞 — Chrome - - 2026-09-09
CVE-2026-78512 Microsoft Office Word 缓冲区错误漏洞 — Microsoft 365 Apps for Enterprise 8.8 High 2026-09-08
CVE-2026-69535 Microsoft Windows Spaceport.sys 缓冲区错误漏洞 — Windows 10 Version 21H2 7.8 High 2026-09-08
CVE-2026-69578 Microsoft Windows Kernel 缓冲区错误漏洞 — Windows 10 Version 1607 7.0 High 2026-09-08
CVE-2026-68895 Microsoft Internet Storage Name Service 数字错误漏洞 — Windows 10 Version 1607 5.5 Medium 2026-09-08
CVE-2026-69822 Microsoft Windows Kerberos 缓冲区错误漏洞 — Windows 10 Version 1809 7.8 High 2026-09-08
CVE-2026-86315 SAMSUNG Escargot 数字错误漏洞 — Escargot 6.2 Medium 2026-09-07
CVE-2026-80213 Ruby Resolv 数字错误漏洞 — resolv 4.0 Medium 2026-08-27
CVE-2026-77014 GNOME libsoup 数字错误漏洞 — Red Hat Enterprise Linux 10 5.3 Medium 2026-08-20
CVE-2026-65610 Arun Prakash Jana nnn 数字错误漏洞 — nnn 2.4 Low 2026-08-19
CVE-2026-73523 covesa Open1722 数字错误漏洞 — Open1722 7.5 High 2026-08-17
CVE-2026-49263 Capstone Engine 数字错误漏洞 — capstone 2.0 Low 2026-08-14
CVE-2026-68804 Microsoft Office Excel 缓冲区错误漏洞 — Microsoft 365 Apps for Enterprise 7.8 High 2026-08-11
CVE-2026-65798 Microsoft Windows DNS 数字错误漏洞 — Windows 10 Version 1607 6.7 Medium 2026-08-11
CVE-2026-65797 Microsoft Windows DNS 缓冲区错误漏洞 — Windows 10 Version 1607 6.7 Medium 2026-08-11
CVE-2026-65795 Microsoft Windows DNS 安全漏洞 — Windows 10 Version 1607 6.7 Medium 2026-08-11
CVE-2026-63525 Microsoft Office Word 数字错误漏洞 — Microsoft 365 Apps for Enterprise 7.8 High 2026-08-11
CVE-2026-62883 Microsoft Windows DNS 缓冲区错误漏洞 — Windows 10 Version 1607 6.7 Medium 2026-08-11
CVE-2026-62881 Microsoft Windows DNS 缓冲区错误漏洞 — Windows 10 Version 1607 6.7 Medium 2026-08-11
CVE-2026-62769 Microsoft Windows DNS 缓冲区错误漏洞 — Windows 10 Version 1607 6.7 Medium 2026-08-11
CVE-2026-62698 Microsoft Windows 数字错误漏洞 — Windows 10 Version 1607 7.8 High 2026-08-11
CVE-2026-55142 Microsoft Office Word 数字错误漏洞 — Microsoft 365 Apps for Enterprise 5.5 Medium 2026-07-14
CVE-2026-50357 Microsoft Windows Resilient File System 数字错误漏洞 — Windows 10 Version 1607 7.8 High 2026-07-14
CVE-2026-49792 Microsoft Windows Resilient File System 数字错误漏洞 — Windows 10 Version 1607 7.8 High 2026-07-14
CVE-2026-44823 Microsoft Office Excel 安全漏洞 — Microsoft 365 Apps for Enterprise 7.8 High 2026-06-09
CVE-2026-40409 Microsoft Windows Universal Disk Format File System Driver 安全漏洞 — Windows 10 Version 1607 7.8 High 2026-06-09
CVE-2026-42944 NLnet Labs Unbound 安全漏洞 — Unbound 8.7 High 2026-05-20
CVE-2026-44927 Uriparser 安全漏洞 — uriparser 2.9 Low 2026-05-08

CWE-197（数值截断错误） 是常见的弱点类别，本平台收录该类弱点关联的 68 条 CVE 漏洞。