CVE-2026-88367

Deferred Deferred - Pending Action

Incorrect Numeric Conversion in NanoSVG Leading to DoS via SVG Stroke

Publication date: 2026-09-24

Last updated on: 2026-09-25

Assigner: MITRE

Description

NanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__curveDivs() during SVG stroke rasterization. A specially crafted SVG document containing an extremely large stroke-width can cause floating-point rounding to produce a zero subdivision angle. The subsequent arc division yields infinity, which is converted to int without range validation, resulting in undefined behavior and process termination, leading to denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-25

Generated

2026-10-15

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-13

NVD

CVE-2026-88367

EUVD

EUVD-2026-86266

Affected Vendors & Products

Vendor	Product	Version / Range
memononen	nanosvg	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-681	When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.

Attack-Flow Graph

Executive Summary

NanoSVG 239e102ec has an incorrect numeric conversion flaw in the nsvg__curveDivs() function during SVG stroke rasterization. A maliciously crafted SVG with an extremely large stroke-width causes floating-point rounding to produce a zero subdivision angle. This leads to an infinite arc division, which is then converted to an integer without validation, causing undefined behavior and process termination, resulting in a denial of service.

Detection Guidance

To detect this vulnerability, inspect SVG files processed by NanoSVG for extremely large stroke-width values (e.g., 10662107277 pixels). Check for crashes or undefined behavior during SVG rendering, particularly when using functions like nsvg__curveDivs or nsvgRasterize. Monitor logs for division by zero or integer overflow errors.

Impact Analysis

This vulnerability can cause applications using NanoSVG to crash or become unresponsive when processing malicious SVG files. This leads to denial of service, disrupting services that rely on SVG rendering for user interfaces, graphics, or data visualization.

Compliance Impact

This vulnerability causes a denial of service by crashing the application processing the SVG file. For compliance with GDPR or HIPAA, such crashes could disrupt services handling personal or health data, potentially leading to availability issues that violate data protection requirements for timely access or processing.

Mitigation Strategies

Update NanoSVG to a patched version that includes range validation for subdivision angles during SVG stroke rasterization. Avoid processing untrusted SVG files with extremely large stroke-width values until the update is applied.

Hi! I’m here to help you understand CVE-2026-88367. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70