CWE-190, Integer Overflow or Wraparound, occurs when a calculation can overflow or wrap around while the logic assumes the result will always be larger than the original value. The integer is pushed past what its type can store and comes back as a very small or negative number.
It matters most in languages with fixed width integers and manual memory handling, like C and C++, but the logic flaw can appear anywhere a size, count, price or quota is computed.
How it happens
The classic pattern is a size calculation. Code multiplies a count by an element size to decide how much memory to allocate, then copies the data. If the multiplication wraps, the allocation is small and the copy is large.
// Vulnerable: count * size can wrap to a small number
size_t total = count * sizeof(struct item);
struct item *p = malloc(total);
for (size_t i = 0; i < count; i++) {
p[i] = src[i]; // writes past the end of the buffer
}
// Fixed: check before multiplying
if (count > SIZE_MAX / sizeof(struct item)) {
return -1;
}
size_t total = count * sizeof(struct item);
struct item *p = malloc(total);
MITRE's observed examples show this chaining with other weaknesses. In CVE-2025-46687, a JavaScript engine did not perform a length check, leading to an integer overflow that allocated a smaller buffer than expected and ended in a heap based buffer overflow. CVE-2025-27363 is a font rendering library that assigned a signed short to an unsigned long, causing wraparound and a buffer too small. CVE-2021-43537 involves a web browser forcibly casting an unsigned 64 bit integer to 32 bits. CVE-2019-19911 is a Python library that did not limit the resources used to process images with a very large number of bands.
What an attacker gains
MITRE lists several outcomes depending on how the value is used:
- Availability: crashes, restarts, memory or CPU exhaustion, including infinite or badly terminated loops when a loop index overflows.
- Integrity: data corruption, and further memory corruption if the overflow leads to a buffer overflow.
- Confidentiality, availability and access control: execution of unauthorized code or commands when a buffer overflow follows, though MITRE notes this is usually outside the product's implicit security policy.
- Access control: bypass of a protection mechanism if the integer feeds a security decision such as a quota or allocation limit.
How to find it
MITRE lists these detection methods:
- Automated static analysis, which can often find this weakness, with data flow or constraint based tools producing fewer false positives.
- Black box testing and fuzzing with many diverse inputs. The product may slow down, but it should not crash or misbehave.
- Manual analysis, including penetration testing, threat modeling and manual review of calculations.
- Binary or bytecode analysis where source is not available.
If you ship third party libraries, many of these bugs arrive as dependency vulnerabilities. A free scan at gold.safeguard.sh/scan runs in the browser, keeps your file on your machine and covers up to 100 dependencies.
How to fix it
The record lists no mitigations, so these are general steps.
- Validate sizes and counts before arithmetic, against the maximum the type allows.
- Use checked arithmetic helpers: compiler builtins such as the overflow checking functions in GCC and Clang, safe integer libraries, or languages with checked math.
- Use unsigned types for sizes and compare carefully, and use wide enough types for the largest legitimate value.
- Cap user controlled lengths and counts at sane limits long before they reach arithmetic.
- Fuzz parsers and decoders, and run tests with sanitizers.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why does an overflow often lead to a buffer overflow?
The overflowed value is used to size an allocation. The allocation is too small, but the code still copies the full amount of data.
What is the safest place to check?
Before the arithmetic. Checking the result afterward can be too late, because the wrapped value already looks valid.
