diff --git a/src/variations.cc b/src/variations.cc
--- a/src/variations.cc
+++ b/src/variations.cc
@@ -92,7 +92,14 @@
     }
   }
 
-  if (!subtable.Skip(valueSize * size_t(itemCount) * (size_t(wordDeltaCount) + size_t(*regionIndexCount)))) {
+  // The individual counts here are 16-bit values, and valueSize is either 1 or 2,
+  // so this cannot overflow.
+  size_t deltaSetSize = valueSize * (size_t(wordDeltaCount) + size_t(*regionIndexCount));
+  // Check that multiplication by itemCount will not overflow size_t.
+  if (itemCount && deltaSetSize > std::numeric_limits<size_t>::max() / itemCount) {
+    return OTS_FAILURE_MSG("Delta data size overflow");
+  }
+  if (!subtable.Skip(deltaSetSize * size_t(itemCount))) {
     return OTS_FAILURE_MSG("Failed to read delta data");
   }