CWE-197 数值截断错误 类弱点 39 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-197 数值截断错误属于数据转换漏洞，发生在将较大类型的数据强制转换为较小类型时，导致高位数据丢失。攻击者常利用此缺陷构造恶意输入，使截断后的值被用作缓冲区索引或循环迭代器，从而引发越界访问或逻辑绕过。开发者应避免隐式类型转换，在数据转换前进行严格的范围检查与验证，确保数值在目标类型的安全范围内，以消除潜在风险。
int intPrimitive; short shortPrimitive; intPrimitive = (int)(~((int)0) ^ (1 << (sizeof(int)*8-1))); shortPrimitive = intPrimitive; printf("Int MAXINT: %d\nShort MAXINT: %d\n", intPrimitive, shortPrimitive);Int MAXINT: 2147483647 Short MAXINT: -1... // update sales database for number of product sold with product ID public void updateSalesForProduct(String productID, int amountSold) { // get the total number of products in inventory database int productCount = inventory.getProductCount(productID); // convert integer values to short, the method for the // sales object requires the parameters to be of type short short count = (short) productCount; short sold = (short) amountSold; // update sales database for product sales.updateSalesCount(productID, count, sold); } ...... // update sales database for number of product sold with product ID public void updateSalesForProduct(String productID, int amountSold) { // get the total number of products in inventory database int productCount = inventory.getProductCount(productID); // make sure that integer numbers are not greater than // maximum value for type short before converting if ((productCount < Short.MAX_VALUE) && (amountSold < Short.MAX_VALUE)) { // convert integer values to short, the method for the // sales object requires the parameters to be of type short short count = (short) productCount; short sold = CWE-197（数值截断错误） 是常见的弱点类别，本平台收录该类弱点关联的 39 条 CVE 漏洞。