AIKIDO-2025-10409

TL;DR

Affected versions of this package are vulnerable to an integer overflow in UTF-32 encoding methods, where processing a UTF-32 byte sequence with a value ≥ 0x80000000 returns a negative integer due to improper handling of signed integers. An attacker could craft a malicious UTF-32 input that triggers this overflow, potentially leading to incorrect character processing, memory corruption, or crashes in applications relying on these functions for string conversion, possibly enabling denial of service (DoS) or other undefined behavior.