CVE-2026-88367
Received Received - Intake

Incorrect Numeric Conversion in NanoSVG Leading to DoS via SVG Stroke

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: MITRE

Description
NanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__curveDivs() during SVG stroke rasterization. A specially crafted SVG document containing an extremely large stroke-width can cause floating-point rounding to produce a zero subdivision angle. The subsequent arc division yields infinity, which is converted to int without range validation, resulting in undefined behavior and process termination, leading to denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-88367
EUVD
EUVD-2026-86266

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

NanoSVG 239e102ec has an incorrect numeric conversion flaw in the nsvg__curveDivs() function during SVG stroke rasterization. A maliciously crafted SVG with an extremely large stroke-width causes floating-point rounding to produce a zero subdivision angle. This leads to an infinite arc division, which is then converted to an integer without validation, causing undefined behavior and process termination, resulting in a denial of service.

Impact Analysis

This vulnerability can cause applications using NanoSVG to crash or become unresponsive when processing malicious SVG files. This leads to denial of service, disrupting services that rely on SVG rendering for user interfaces, graphics, or data visualization.

Mitigation Strategies

Update NanoSVG to a patched version that includes range validation for subdivision angles during SVG stroke rasterization. Avoid processing untrusted SVG files with extremely large stroke-width values until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88367. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart