CVE-2026-66920
Received Received - Intake

Recursive Stack Overflow in Pivotick Graph Algorithms

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: 5a6e4751-2f3f-4070-9419-94fb35b644e8

Description
Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph and node data. The affected graph algorithms recursively traversed graph edges, while the JSON viewer recursively processed each level of a node’s data structure. A specially crafted graph containing an excessively long path, deeply nested properties, or circular object references could therefore exhaust the JavaScript call stack when Pivotick calculates a layout or displays a node in the inspection modal. Successful exploitation may cause an uncaught exception, freeze the affected page, or crash the browser tab, resulting in a client-side denial of service. No confidentiality or integrity impact has been identified. The patch replaces the recursive graph traversals with iterative stack-based implementations and limits the reachability calculation to 1,000,000 edge traversals. It also limits JSON rendering to 64 levels and detects circular references before descending further into an object.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-66920
EUVD
EUVD-2026-49796

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pivotick pivotick *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-66920 is an uncontrolled-recursion vulnerability in Pivotick where recursive graph algorithms and JSON processing can exhaust the JavaScript call stack. This happens when the application processes maliciously crafted graphs with long paths, deeply nested structures, or circular references. The vulnerability leads to client-side denial of service by freezing pages or crashing browser tabs.

Detection Guidance

Detecting this vulnerability requires checking for excessive recursion or stack exhaustion in Pivotick when processing graphs or JSON data. Monitor browser console errors for stack overflow messages or unresponsive tabs. Test with large or maliciously crafted inputs to observe crashes or freezes.

Impact Analysis

This vulnerability can cause your browser tab to freeze or crash when interacting with Pivotick, disrupting normal use. It does not compromise data confidentiality or integrity but may lead to temporary unavailability of the application.

Compliance Impact

This vulnerability does not directly impact confidentiality or integrity of data, as stated in the CVE description. It causes client-side denial of service by freezing or crashing the browser tab, which may indirectly affect compliance by disrupting system availability. However, no evidence suggests it leads to unauthorized data access or modification required for GDPR or HIPAA violations.

Mitigation Strategies
  • Update Pivotick to the patched version to replace recursive algorithms with iterative stack-based implementations.
  • Limit graph traversals to 1,000,000 edges and JSON rendering to 64 levels to prevent stack exhaustion.
  • Implement input validation to reject excessively long paths, deeply nested structures, or circular references in user-supplied data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66920. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart