CVE-2026-88355
Deferred Deferred - Pending Action

Incorrect Buffer Size Calculation in tinyexpr Library

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: MITRE

Description
An incorrect buffer size calculation vulnerability exists in tinyexpr commit 4a7456e in new_expr(). For arity-0 expression nodes, including constants, variables, and zero-argument functions, the function allocates less memory than sizeof(te_expr) but treats the returned allocation as a complete te_expr object. This results in undefined behavior and can cause deterministic process termination in UBSan-instrumented builds.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-25
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-88355
EUVD
EUVD-2026-86286

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
szaydel tinyexpr *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an incorrect buffer size calculation in the tinyexpr library's new_expr() function. For nodes with zero arguments (like constants or variables), the function allocates less memory than needed for the te_expr structure. This causes undefined behavior and can crash programs in builds with UndefinedBehaviorSanitizer (UBSan).

Detection Guidance

To detect this vulnerability, inspect systems using the tinyexpr library for crashes or UBSan errors when processing arithmetic expressions. Check for heap allocation mismatches in arity-0 nodes by running applications with UBSan enabled and monitoring for object-size violations during expression parsing.

Impact Analysis

If you use the tinyexpr library in a program compiled with UBSan, this bug could cause your program to crash deterministically when processing certain expressions. Even without UBSan, it risks memory corruption if the struct layout changes or parameters are accessed.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a memory allocation bug in the tinyexpr library. However, if exploited, it could lead to application crashes or undefined behavior, potentially causing data processing interruptions or corruption. Such disruptions might indirectly impact compliance by affecting the integrity or availability of personal or sensitive data.

Mitigation Strategies

Update the tinyexpr library to a version that uses flexible array members for the parameters array in te_expr, ensuring proper memory allocation for all node types. Alternatively, apply a patch that adjusts malloc calculations to reserve at least sizeof(te_expr) bytes for arity-0 nodes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88355. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart