{
  "node_id": "mitre-cwe-190-integer-overflow",
  "title": "MITRE CWE-190 - Integer Overflow or Wraparound",
  "domain": "Cybersecurity",
  "version": "1.0.0",
  "last_updated": "2026-06-05",
  "bluf": "CWE-190 (Integer Overflow or Wraparound) is a CWE Top 25 weakness that frequently sits underneath buffer overflow, heap corruption, and protection-bypass vulnerabilities. CWE-190 is defined as: the product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. When an integer value is incremented beyond its maximum representable range, it becomes very small or negative rather than growing as expected. Common Consequences include availability impact (integer overflow can cause crashes, resource exhaustion, or instability; when calculations determine resource allocation, incorrect results may lead to excessive or insufficient resource requests); integrity impact (data corruption occurs when overflow results affect important values; additional memory corruption may occur if overflow triggers buffer overflow conditions); confidentiality and access control impact (overflows can trigger buffer overflows enabling arbitrary code execution; integer overflows in security-critical decisions such as quota or limit calculations can bypass protection mechanisms); and logic and availability impact (when overflow occurs in loop indices, loops may terminate incorrectly, creating infinite loops or excessive iterations that consume resources and crash systems). Potential Mitigations include input validation (validate numeric inputs ensuring they remain within expected ranges, checking both minimum and maximum boundaries; prefer unsigned integers when feasible); language selection (use languages with automatic bounds checking or those preventing this weakness); libraries and frameworks (employ vetted libraries like SafeInt in C++ or IntegerLib offering safe integer handling without unexpected consequences); and compiler hardening (address compiler warnings about signed/unsigned mismatches and uninitialized variables that could enable exploitation). Modern mitigations include UndefinedBehaviorSanitizer (UBSan) with -fsanitize=integer in test builds, checked arithmetic primitives (Rust checked_add, Go math/bits, C++ __builtin_add_overflow), and language-level overflow trapping (Swift, Ada).",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "industry_mapping",
      "related_frameworks"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "mitre-cwe-119-out-of-bounds-memory-buffer"
  ],
  "primary_citations_count": 10
}