CVE-2026-88367 Details
Description
NanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__curveDivs() during SVG stroke rasterization. A specially crafted SVG document containing an extremely large stroke-width can cause floating-point rounding to produce a zero subdivision angle. The subsequent arc division yields infinity, which is converted to int without range validation, resulting in undefined behavior and process termination, leading to denial of service.
A vulnerability in NanoSVG's SVG stroke rasterization process has been identified, specifically in the function nsvg__curveDivs(). This issue arises from an incorrect numeric conversion that allows a specially crafted SVG document with an extremely large stroke width to cause floating-point rounding errors. These errors can produce a zero subdivision angle, which, when processed, results in an infinite value. This infinite value is then converted to an integer without proper range validation, leading to undefined behavior and causing the process to terminate. This vulnerability has been confirmed to exist in NanoSVG commit 239e102ec.
Users are advised to update to the latest version of NanoSVG, where this vulnerability has been addressed. The updated version includes a fix that clamps the stroke width value to prevent extreme values from causing issues during the tessellation process.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026CISA-ADP
Assessed Sep 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/memononen/nanosvg/issues/293 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/memononen/nanosvg/issues/293 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-681 | Incorrect Conversion between Numeric Types | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| NanoSVG | 239e102ec2c691f2902e20ace2ed36ee4a35cfe6 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 25, 2026 | CVE Modified | CISA-ADP |
| Sep 24, 2026 | New CVE Received | [email protected] |