Integer Underflow (Wrap or Wraparound)

Integer underflow, also known as wraparound, happens when a program subtracts a larger number from a smaller one, pushing the result below the minimum value the integer type can hold. Instead of throwing an error, the value wraps around to the maximum end of the range—for example, an unsigned 8-bit integer going from 0 to 255 after subtracting 1. This creates a logic flaw where the program operates on a wildly incorrect value, often leading to unexpected behavior. This vulnerability affects both signed and unsigned integers and is a common source of critical security flaws. In signed integers, underflow can flip a positive value to a massive negative one, while in unsigned integers, it creates an unexpectedly large positive value. Developers must validate all subtraction inputs, use safe math libraries, or choose data types with sufficient range to prevent these dangerous wrap-around scenarios.