CVE-2026-88355 Details

A vulnerability exists in tinyexpr in commit 4a7456e, where an incorrect buffer size calculation leads to undefined behavior. This issue arises in the 'new_expr()' function, which allocates insufficient memory for arity-0 expression nodes, such as constants, variables, and zero-argument functions. The function incorrectly assumes that a smaller allocation can accommodate a full 'te_expr' object, resulting in a buffer underflow. This vulnerability can cause a deterministic process termination in builds in instrumented with Undefined Behavior Sanitizer (UBSan).

The vulnerability has been addressed in a commit that modifies the memory allocation in 'new_expr()' to ensure it always allocates enough space for a full 'te_expr' object. Users should apply this update to mitigate the vulnerability.