Integer Overflow or Wraparound

Description

Integer Overflow or Wraparound occurs when an arithmetic operation produces a numeric value that exceeds the maximum value that can be stored in the target integer type. When this happens, the value "wraps around" to a small number (or negative number for signed integers). In unsigned arithmetic, overflow wraps to zero; in signed arithmetic, behavior is undefined in C/C++ but typically wraps to the minimum negative value. Integer overflows are particularly dangerous when the result is used for memory allocation sizes, array indices, or security-critical calculations.

Risk

Integer overflow vulnerabilities are ranked among the CWE Top 25 Most Dangerous Software Weaknesses. They enable attackers to transform large values into small values, bypassing size checks and causing undersized buffer allocations that are subsequently overflowed. Integer overflows have enabled remote code execution in countless applications, from image processors handling width×height calculations to network services parsing length fields. Critical sectors including finance (transaction manipulation), gaming (currency exploits), healthcare, and industrial control systems face severe operational damage from integer overflow exploitation.

Solution

Always validate that arithmetic operations will not overflow before performing them. Use safe integer libraries (SafeInt in C++, checked arithmetic in Rust). Check against type limits (INT_MAX, SIZE_MAX) before operations. Use larger integer types where overflow is possible. Enable compiler options that detect overflow (-ftrapv for signed, -fsanitize=unsigned-integer-overflow). Avoid mixing signed and unsigned integers in calculations. Use static analysis tools to identify potential overflow points. Consider using arbitrary-precision arithmetic for critical calculations.

Common Consequences

Impact	Details
Integrity	Scope: Memory Corruption Overflow in size calculations leads to undersized allocations and subsequent buffer overflows.
Access Control	Scope: Code Execution Buffer overflows resulting from integer overflow enable arbitrary code execution.
Availability	Scope: Resource Exhaustion Overflow causing large allocations leads to memory exhaustion; infinite loops from counter overflow cause DoS.

Example Code + Solution Code

Vulnerable Code

#include <stdlib.h>
#include <stdint.h>

// VULNERABLE: Multiplication overflow
void *allocate_image(unsigned int width, unsigned int height) {
    // If width * height overflows, allocates tiny buffer
    size_t size = width * height * 4;  // 4 bytes per pixel

    char *buffer = malloc(size);

    // Writing to buffer with original dimensions causes overflow
    for (unsigned int y = 0; y < height; y++) {
        for (unsigned int x = 0; x < width; x++) {
            buffer[(y * width + x) * 4] = 0;  // Massive overflow
        }
    }
    return buffer;
}

// VULNERABLE: Addition overflow in loop
void process_packets(uint16_t count, uint16_t size) {
    uint16_t total = count * size;  // Overflow if count=1000, size=100

    // total may be much smaller than expected
    char *buffer = malloc(total);
    // Processing assumes original sizes
}

// VULNERABLE: Signed overflow (undefined behavior)
int calculate_position(int base, int offset) {
    // If offset is large positive, sum may overflow to negative
    int position = base + offset;

    if (position < 0) {
        return 0;  // Never reached if overflow is optimized out
    }
    return position;
}

Fixed Code

#include <stdlib.h>
#include <stdint.h>
#include <limits.h>
#include <stdbool.h>

// SAFE: Check overflow before multiplication
void *allocate_image_safe(size_t width, size_t height) {
    // Check width * height doesn't overflow
    if (width != 0 && height > SIZE_MAX / width) {
        return NULL;
    }
    size_t pixels = width * height;

    // Check pixels * 4 doesn't overflow
    if (pixels > SIZE_MAX / 4) {
        return NULL;
    }
    size_t size = pixels * 4;

    char *buffer = calloc(pixels, 4);  // calloc may also check
    return buffer;
}

// SAFE: Overflow-checking multiplication
bool safe_multiply(size_t a, size_t b, size_t *result) {
    if (a != 0 && b > SIZE_MAX / a) {
        return false;  // Would overflow
    }
    *result = a * b;
    return true;
}

// SAFE: Overflow-checking addition for signed integers
bool safe_add_signed(int a, int b, int *result) {
    if (b > 0 && a > INT_MAX - b) {
        return false;  // Positive overflow
    }
    if (b < 0 && a < INT_MIN - b) {
        return false;  // Negative overflow
    }
    *result = a + b;
    return true;
}

// SAFE: Using compiler built-ins (GCC/Clang)
void *allocate_checked(size_t count, size_t size) {
    size_t total;

    // __builtin_mul_overflow returns true on overflow
    if (__builtin_mul_overflow(count, size, &total)) {
        return NULL;
    }

    return malloc(total);
}

---

Exploited in the Wild

Microsoft Windows Speech (Windows 11, 2025)

CVE-2025-58715 is an integer overflow in Windows Speech component allowing local attackers to escalate privileges to SYSTEM. CVSS score 8.8 with high impact on confidentiality, integrity, and availability.

• https://msrc.microsoft.com/update-guide/

Financial Sector Transaction Manipulation (Banking, Multiple)

Integer overflow vulnerabilities in banking systems have allowed attackers to manipulate transaction values, causing significant financial losses. Implementation of input validation and boundary checks mitigated these issues.

• https://www.fsisac.com/

Gaming Currency Exploits (Online Games, Multiple)

Multiple online games have experienced exploits where players overflow currency counters to gain unlimited in-game funds, causing economic disruption in game ecosystems.

• https://www.gamedeveloper.com/

OpenSSH Authentication Bypass (OpenSSH, 2002)

CVE-2002-0639 was an integer overflow in OpenSSH's challenge-response authentication enabling remote code execution, demonstrating early real-world impact of this vulnerability class.

• https://www.openssh.com/security.html

---

Tools to test/exploit

• UBSan — undefined behavior sanitizer detecting signed overflow.

• SafeInt — C++ library for overflow-safe integer arithmetic.

• AFL++ — fuzzer effective at discovering integer overflow conditions.

• IntScope — static analyzer for integer vulnerabilities.

---

CVE Examples

• CVE-2025-58715 — Windows 11 Speech integer overflow for privilege escalation.

• CVE-2002-0639 — OpenSSH challenge-response integer overflow.

• CVE-2023-4863 — libwebp integer overflow enabling heap buffer overflow.

---

References

1. MITRE. "CWE-190: Integer Overflow or Wraparound." https://cwe.mitre.org/data/definitions/190.html

2. CERT. "INT30-C. Ensure that unsigned integer operations do not wrap." https://wiki.sei.cmu.edu/confluence/display/c/INT30-C

3. CWE Top 25. "2024 CWE Top 25 Most Dangerous Software Weaknesses." https://cwe.mitre.org/top25/