The vulnerability arises from pointer difference values being truncated to an int in several parts of uriparser before version 1.0.2. This truncation can lead to incorrect arithmetic, potentially causing integer overflows if the truncated value is later used in calculations. The flaw does not by itself expose confidentiality or availability, but it can compromise the integrity of URI parsing results. The weakness is classified as an integer conversion error, corresponding to CWE‑197.

The affected product is uriparser, in any build prior to release 1.0.2. Applications or services that link against these older uriparser versions are potentially impacted.

The CVSS score of 2.9 indicates low severity. EPSS information is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to be through crafted URI input that triggers the code paths where truncation occurs; an attacker would need to supply such input to the application using the vulnerable library, making the exploitation path difficult but not impossible.