CVE-2026-53531

Received Received - Intake

Stack Overflow in RaTeX Math Rendering Engine

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, RaTeX’s recursive-descent parser recurses one (or more) native stack frame per nesting level at `{`, `\left`, `\sqrt{`, `^{`, etc, with no maximum depth limit. A short, ~10 KB input of nested groups overflows the 8 MB main-thread stack and aborts the process. With `panic = "abort"` (`Cargo.toml:48`), and because a Rust stack overflow is always a fatal `SIGABRT` regardless of panic strategy this is an unrecoverable, whole-process denial of service reachable from a single untrusted LaTeX string. Version 0.1.11 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-53531

Affected Vendors & Products

Vendor	Product	Version / Range
latex	ratex	to 0.1.11 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

RaTeX is a math rendering engine for LaTeX compatible with KaTeX. Prior to version 0.1.11, it had a flaw where its parser would use excessive stack space for deeply nested LaTeX expressions like curly braces or math commands. A small 10 KB input with many nested levels could crash the program by overflowing the stack, causing a denial of service.

Detection Guidance

This vulnerability can be detected by monitoring for crashes or SIGABRT signals when processing LaTeX strings with deep nesting. Check logs for process aborts during LaTeX rendering tasks. No specific commands are provided in the context.

Impact Analysis

If you use RaTeX to render LaTeX strings from untrusted sources, an attacker could send a specially crafted LaTeX string that causes the program to crash. This would stop the rendering service until manually restarted, disrupting any dependent applications or workflows.

Compliance Impact

This vulnerability causes a denial of service via stack overflow, which could disrupt services processing LaTeX input. While not directly related to data protection, such disruptions may impact availability requirements under GDPR or HIPAA if systems fail to operate as intended.

Mitigation Strategies

Update RaTeX to version 0.1.11 or later to fix the stack overflow issue. If updating is not possible, restrict input to trusted LaTeX strings and limit nesting depth in parser configurations.

Hi! I’m here to help you understand CVE-2026-53531. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70