CVE-2026-88368
Deferred Deferred - Pending Action

Incorrect Numeric Conversion in NanoSVG Rasterizer Leads to DoS

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: MITRE

Description
NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in the rasterizer's nsvg__addActive() function. A specially crafted SVG document containing sufficiently large geometry coordinates can cause fixed-point-scaled edge coordinates to exceed the range representable by int. The rasterizer subsequently converts these values to int without range validation, resulting in undefined behavior and possible process termination, leading to denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-25
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-88368
EUVD
EUVD-2026-86267

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
memononen nanosvg *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-681 When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an incorrect numeric conversion issue in the NanoSVG library's rasterizer function nsvg__addActive(). It occurs when processing SVG documents with extremely large geometry coordinates. The library converts these coordinates to a fixed-point representation without proper range validation, causing integer overflows when casting to 32-bit integers. This leads to undefined behavior and potential process termination.

Detection Guidance

To detect this vulnerability, inspect SVG files processed by NanoSVG for extremely large coordinate values in path data. Use tools like grep to search for unusually large numbers in SVG files or logs. Example command: grep -E '[-+]?[0-9]{8,}' *.svg. If NanoSVG is used in a program, enable debug logging to check for integer overflow warnings during coordinate processing.

Impact Analysis

An attacker could exploit this vulnerability by providing a maliciously crafted SVG file with extreme coordinate values. When processed by NanoSVG, this could cause the application to crash or exhibit memory corruption, leading to denial of service. Users relying on NanoSVG for SVG rendering may experience application failures.

Compliance Impact

This vulnerability primarily causes denial of service through process termination, which may indirectly impact compliance by disrupting systems processing SVG files. However, the CVE data does not specify direct effects on GDPR or HIPAA compliance. Denial of service could lead to service unavailability, potentially violating availability requirements in these standards.

Mitigation Strategies

Immediately update NanoSVG to a patched version that includes range checks for fixed-point coordinate conversions. If updating is not possible, restrict SVG file processing to trusted sources only. Implement input validation to reject SVG files with coordinates exceeding a safe threshold (e.g., 2.1e6). Monitor applications using NanoSVG for crashes or memory corruption as potential indicators of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88368. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart