NanoSVG CVE-2026-88366

Exploitation requires that the target application uses NanoSVG (at/around commit 239e102ec) to parse an attacker-controlled SVG document, and that the SVG reaches nsvg__pathArcTo() via an arc command containing extreme radius values that drive the delta-angle computation to NaN. The limiting factors: the attacker must be able to supply or cause rendering of an SVG file, and in deployments where SVGs are opened manually rather than parsed automatically, user interaction is effectively required despite the UI:N in the published vector. Impact is confined to a crash of the single parsing process (S:U), with no confidentiality or integrity effect, so multi-process or sandboxed renderers limit the blast radius to the affected worker.

This is a genuine but low-urgency issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) reflects a remotely reachable, low-complexity, unauthenticated crash with availability-only impact - the 'High' score is driven entirely by the A:H availability metric, not by any confidentiality or integrity consequence. The real-world signals temper this: EPSS is only 0.16% (4th percentile), there is no CISA KEV listing, and no public exploit code is referenced, so there is no evidence of exploitation. The vulnerability is a denial-of-service only (NaN-to-int conversion causing process termination), meaning the worst case is a crash of whatever host process parses the malicious SVG, not code execution or data compromise. Note a nuance the CVSS vector understates: NanoSVG is a library, so AV:N and UI:N only hold when the embedding application automatically fetches and parses attacker-supplied SVGs without user interaction; in applications where a user must open a file, real exploitation is closer to AV:N/UI:R. Overall this is a high-CVSS-but-moderate-real-risk DoS: worth patching in SVG-handling services, but not an emergency.

An attacker crafts an SVG document containing an arc command (A/a) with extreme radius values that cause nsvg__pathArcTo() to compute a NaN delta angle, then submits it to an application that embeds NanoSVG for rendering (e.g. an image-upload or thumbnailing service). When the library converts the NaN to an int without a finite-value check, the process hits undefined behavior and terminates, dropping the service. No public exploit code is referenced, though the triggering condition is described in detail in the upstream GitHub issue.