CWE WEAKNESSES / CWE-194
CWE-194
Unexpected Sign Extension
Variant EXPLOIT LIKELIHOOD: HIGH
What it is
The product performs an operation on a number that causes it to be sign extended when it is transformed into a larger data type. When the original number is negative, this can produce unexpected values that lead to resultant weaknesses.
Impact
| Integrity, Confidentiality, Availability, Other | Read Memory, Modify Memory, Other |
Mitigations
- [Implementation] Avoid using signed variables if you don't need to represent negative values. When negative values are needed, perform validation after you save those values to larger data types, or before passing them to functions that are expecting unsigned values.
Real-world CVE examples
- CVE-2018-10887 — Chain: unexpected sign extension (CWE-194) leads to integer overflow (CWE-190), causing an out-of-bounds read (CWE-125)
- CVE-1999-0234 — Sign extension error produces -1 value that is treated as a command separator, enabling OS command injection.
- CVE-2003-0161 — Product uses "char" type for input character. When char is implemented as a signed type, ASCII value 0xFF (255), a sign extension produces a -1 value that is tr
- CVE-2007-4988 — chain: signed short width value in image processor is sign extended during conversion to unsigned int, which leads to integer overflow and heap-based buffer ove
- CVE-2006-1834 — chain: signedness error allows bypass of a length check; later sign extension makes exploitation easier.
- CVE-2005-2753 — Sign extension when manipulating Pascal-style strings leads to integer overflow and improper memory copy.
Related weaknesses
Test & detect
Browse all common weaknesses, check related exploited CVEs, or map to ATT&CK techniques.
Source: MITRE CWE. View on cwe.mitre.org →