CWE-195 Variant Draft

Signed to Unsigned Conversion Error

This vulnerability occurs when a signed integer (which can hold negative values) is converted to an unsigned integer (which holds only non-negative values). If the original signed value is negative,…

Definition

What is CWE-195?

This vulnerability occurs when a signed integer (which can hold negative values) is converted to an unsigned integer (which holds only non-negative values). If the original signed value is negative, the conversion produces a large, unexpected positive number instead of an error, breaking the program's logic.
Implicit conversions between signed and unsigned numbers are a common source of bugs because they happen silently during assignments or function calls. Developers often assume the value remains semantically the same, but a negative signed number becomes a very large unsigned number. This violates program assumptions and can lead to incorrect calculations, infinite loops, or flawed condition checks. A critical risk emerges when these converted values control memory operations. Many functions return negative numbers to signal errors (like -1). If such a return value is passed directly as a 'size' argument to functions like memcpy() or malloc(), the implicit conversion turns the failure indicator into a massive allocation or copy length. This typically causes a buffer overflow, crashing the program or creating a serious security exploit.
Real-world impact

Real-world CVEs caused by CWE-195

  • CVE-2025-27363

    Font rendering library does not properly handle assigning a signed short value to an unsigned long (CWE-195), leading to an integer wraparound (CWE-190), causing too small of a buffer (CWE-131), leading to an out-of-bounds write (CWE-787).

  • CVE-2007-4268

    Chain: integer signedness error (CWE-195) passes signed comparison, leading to heap overflow (CWE-122)

How attackers exploit it

Step-by-step attacker path

  1. 1

    In this example the variable amount can hold a negative value when it is returned. Because the function is declared to return an unsigned int, amount will be implicitly converted to unsigned.

  2. 2

    If the error condition in the code above is met, then the return value of readdata() will be 4,294,967,295 on a system that uses 32-bit integers.

  3. 3

    In this example, depending on the return value of accecssmainframe(), the variable amount can hold a negative value when it is returned. Because the function is declared to return an unsigned value, amount will be implicitly cast to an unsigned number.

  4. 4

    If the return value of accessmainframe() is -1, then the return value of readdata() will be 4,294,967,295 on a system that uses 32-bit integers.

  5. 5

    The following code is intended to read an incoming packet from a socket and extract one or more headers.

Vulnerable code example

Vulnerable C

In this example the variable amount can hold a negative value when it is returned. Because the function is declared to return an unsigned int, amount will be implicitly converted to unsigned.

Vulnerable C 
unsigned int readdata () {
  	int amount = 0;
  	...
  	if (result == ERROR)
  	amount = -1;
  	...
  	return amount;
  }
Secure code example

Secure pseudo

Secure pseudo 
// Validate, sanitize, or use a safe API before reaching the sink.
function handleRequest(input) {
  const safe = validateAndEscape(input);
  return executeWithGuards(safe);
}
What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Prevention checklist

How to prevent CWE-195

  • Architecture Use safe-by-default frameworks and APIs that prevent the unsafe pattern from being expressible.
  • Implementation Validate input at trust boundaries; use allowlists, not denylists.
  • Implementation Apply the principle of least privilege to credentials, file paths, and runtime permissions.
  • Testing Cover this weakness in CI: SAST rules + targeted unit tests for the data flow.
  • Operation Monitor logs for the runtime signals listed in the next section.
Detection signals

How to detect CWE-195

Automated Static Analysis High

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Plexicus auto-fix

Plexicus auto-detects CWE-195 and opens a fix PR in under 60 seconds.

Codex Remedium scans every commit, identifies this exact weakness, and ships a reviewer-ready pull request with the patch. No tickets. No hand-offs.

Get a demo Try Plexicus free
Frequently asked questions

Frequently asked questions

What is CWE-195?

This vulnerability occurs when a signed integer (which can hold negative values) is converted to an unsigned integer (which holds only non-negative values). If the original signed value is negative, the conversion produces a large, unexpected positive number instead of an error, breaking the program's logic.

How serious is CWE-195?

MITRE has not published a likelihood-of-exploit rating for this weakness. Treat it as medium-impact until your threat model proves otherwise.

What languages or platforms are affected by CWE-195?

MITRE lists the following affected platforms: C, C++.

How can I prevent CWE-195?

Use safe-by-default frameworks, validate untrusted input at trust boundaries, and apply the principle of least privilege. Cover the data-flow signature in CI with SAST.

How does Plexicus detect and fix CWE-195?

Plexicus's SAST engine matches the data-flow signature for CWE-195 on every commit. When a match is found, our Codex Remedium agent opens a fix PR with the corrected code, tests, and a one-line summary for the reviewer.

Where can I learn more about CWE-195?

MITRE publishes the canonical definition at https://cwe.mitre.org/data/definitions/195.html. You can also reference OWASP and NIST documentation for adjacent guidance.

Related weaknesses

Weaknesses related to CWE-195

CWE-681 Parent

Incorrect Conversion between Numeric Types

This vulnerability occurs when a program converts a value from one numeric type to another (like a 64-bit integer to a 32-bit integer) and…

CWE-192 Sibling

Integer Coercion Error

An integer coercion error occurs when a program incorrectly converts, extends, or truncates a number between different data types, leading…

CWE-194 Sibling

Unexpected Sign Extension

This vulnerability occurs when a signed number from a smaller data type is moved or cast to a larger type, causing its sign bit to be…

CWE-196 Sibling

Unsigned to Signed Conversion Error

This vulnerability occurs when a program takes an unsigned integer and converts it directly to a signed integer. If the original unsigned…

CWE-197 Sibling

Numeric Truncation Error

A numeric truncation error happens when a program converts a number to a smaller data type, cutting off its higher-order bits and…

CWE-119 Can precede

Improper Restriction of Operations within the Bounds of a Memory Buffer

This vulnerability occurs when software accesses a memory buffer but reads from or writes to a location outside its allocated boundary.…

Resources

Further reading

Ready when you are

Stop paying per developer.
Start closing the loop.

Plexicus is the AI-native ASPM that scans, filters, fixes, pentests, and explains — autonomously. Unlimited developers, unlimited repos, fair-use AI actions. Real free tier, €269/mo annual when you're ready.

Get started free Book a demo