An integer overflow or wraparound flaw has been discovered in the swoole-src project, specifically within the third‑party hiredis modules and the sds.C source file. The vulnerability allows an attacker to supply crafted input that overflows an integer variable, potentially corrupting memory and causing undefined behavior. The high CVSS score of 10 reflects the critical risk of this flaw.

The flaw affects all installations of swoole-src older than version 6.0.2. Users relying on the third‑party hiredis modules are particularly at risk. The affected components are within the swoole-src repository, identified as swoole:swoole-src.

The CVSS base score indicates a critical level of risk, and although the EPSS score is less than 1%, the vulnerability is not yet catalogued in CISA’s KEV list. The flaw resides in code that processes network or external input, but no explicit remote exploitation path is documented. An attacker could potentially trigger the overflow by sending crafted input to the hiredis component.