CWE-191Integer Underflow (Wrap or Wraparound)

Abstraction: Base · CVEs in our corpus: 523

The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

This can happen in signed and unsigned cases.

Last updated: 11 August 2026 21:18 UTC

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

PR.PS-06
SA-11 Developer Testing and Evaluation
ID.RA-01
PR.PS-02

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2014-0497` KEV	9.9	9.8	0.9988	2014-02-05
`CVE-2024-38063`	9.8	9.8	0.7056	2024-08-13
`CVE-2022-0185` KEV	8.9	8.4	0.2515	2022-02-11
`CVE-2023-42118`	8.6	8.8	0.5175	2024-05-03
`CVE-2005-0199`	8.5	9.8	0.1877	2005-05-02
`CVE-2021-31956` KEV	8.5	7.8	0.2027	2021-06-08
`CVE-2020-36221`	8.4	7.5	0.8422	2021-01-26
`CVE-2020-36228`	8.4	7.5	0.8338	2021-01-26
`CVE-2023-31102`	8.4	7.8	0.7104	2023-11-03
`CVE-2017-14496`	8.3	7.5	0.6635	2017-10-03
`CVE-2016-10166`	8.2	9.8	0.1069	2017-03-15
`CVE-2018-20180`	8.1	9.8	0.0821	2019-03-15
`CVE-2018-20181`	8.1	9.8	0.0821	2019-03-15
`CVE-2018-20179`	8.0	9.8	0.0679	2019-03-15
`CVE-2020-15900`	7.9	9.8	0.0519	2020-07-28
`CVE-2016-1925`	7.8	9.8	0.0299	2017-01-23
`CVE-2017-9214`	7.8	9.8	0.0289	2017-05-23
`CVE-2018-14353`	7.8	9.8	0.0370	2018-07-17
`CVE-2018-14817`	7.8	9.8	0.0358	2018-09-26
`CVE-2020-28194`	7.8	9.8	0.0300	2021-02-01
`CVE-2015-0537`	7.7	9.8	0.0264	2015-08-20
`CVE-2017-8911`	7.7	9.8	0.0193	2017-05-12
`CVE-2017-11757`	7.7	9.8	0.0249	2017-07-31
`CVE-2015-2311`	7.7	9.8	0.0254	2017-08-09
`CVE-2019-14192`	7.7	9.8	0.0270	2019-07-31