EUVD-2026-86267
GHSA-p7cc-752h-fv9q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft SVG with oversized coordinates
-
DeliveryDeliver via upload or remote fetch
-
ExploitApp rasterizes untrusted SVG
-
ExecutionOut-of-range int conversion in nsvg__addActive()
-
PersistUndefined behavior crashes process
-
ImpactDenial of service
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Requires the host application to parse and RASTERIZE an attacker-supplied SVG document (nsvg__addActive runs during rasterization, not merely parsing) containing sufficiently large path/geometry coordinates that overflow the int range after fixed-point scaling. Exploitation is limited to a crash/process termination (availability only) with no code execution or data exposure. The 'remote/network' character depends on the embedding application exposing SVG rasterization to untrusted input (e.g., image upload, remote SVG rendering); tools that only process locally-trusted assets face a local-input vector instead. No authentication or user interaction is required at the library level once the SVG reaches the rasterizer. |
| Impact | The vendor/MITRE CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H = 7.5) rates this as a remote, unauthenticated, low-complexity availability-only issue, which is internally consistent for a crash-style denial of service in a parsing library. However, the AV:N designation is inherited from the consuming application, not from NanoSVG itself - NanoSVG is a library, so 'network' exposure only holds where the embedding application accepts attacker-supplied SVG (e.g., uploads, remote content); in a purely local/offline tool the practical vector is closer to AV:L. There is no EPSS score, no CISA KEV listing, and no public exploit code referenced, so per available signals this is 'no public exploit identified at time of analysis.' The impact is strictly availability (CWE-681 incorrect numeric conversion causing undefined behavior and process termination) with no confidentiality or integrity effect, so despite the 7.5 'High' rating this is a lower real-world priority than the number suggests: it is a bounded crash, not memory-corruption-to-RCE, and exploitation depends entirely on how the host application ingests SVG. Note the CPE is a placeholder ('n/a'), so affected-product enumeration is unreliable and must be pinned to the source commit (239e102ec) rather than a version range. |
| Exploit ScenarioDerived | An attacker uploads or serves a crafted SVG file whose path geometry uses extremely large coordinate values to an application that embeds NanoSVG's rasterizer. When the app rasterizes the image, nsvg__addActive() converts fixed-point-scaled edge coordinates that exceed INT range to int without validation, triggering undefined behavior and crashing the process. No public exploit code is referenced, but the trigger is a single static file and requires no authentication or user interaction beyond the app processing the image. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Denial of service in NanoSVG (commit 239e102ec) where a crafted SVG document carrying oversized geometry coordinates drives the rasterizer's fixed-point-scaled edge values past the range of a 32-bit int during nsvg__addActive(), producing undefined behavior that can terminate the process. The issue is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), i.e. unauthenticated and low-complexity, but availability-only: there is no code execution, data disclosure, or integrity impact per the assessed vector. Exploitation requires the embedding application to actually rasterize attacker-supplied SVG content rather than merely parse it, so tools that only handle locally trusted assets face a local-input scenario; no public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV), though the vendor issue tracker reference (GitHub issue 292) makes root-cause details publicly discoverable.
RemediationAI
No vendor-released patch identified at time of analysis: the only upstream reference supplied is GitHub issue 292 (https://github.com/memononen/nanosvg/issues/292), which documents the defect but is not a tagged release or a confirmed fix commit, so a patched version number cannot be cited and any update should be validated by checking that the vendored rasterizer clamps or range-checks the fixed-point scaling in nsvg__addActive() before narrowing to int. Until such a fix is upstreamed and pinned, apply compensating controls. First, reject or sanitize attacker-supplied SVG input before it reaches the rasterizer: enforce a coordinate-magnitude limit (for example reject or clamp absolute path coordinate values above a conservative bound) and cap path point counts; the trade-off is that legitimate large-coordinate or viewBox-extreme graphics may be refused or rendered incorrectly. Second, if the application only needs to display or store vector data, stop calling the rasterization API on untrusted documents entirely, since nsvg__addActive() is reached during rasterization and not during parsing; the trade-off is that thumbnails or previews must be produced by a different, hardened renderer. Third, where rasterization of untrusted SVGs is unavoidable, run it in an isolated worker/subprocess with strict CPU-time and memory limits plus automatic restart-on-crash so an overflow terminates only the sandboxed renderer and not the primary service; the trade-off is added latency, per-process overhead, and the need to treat worker exits as failed renders. Finally, apply input-size and rate limits at the ingestion boundary (image upload, URL-fetch proxy) and monitor for renderer process exits as an exploitation signal, since the observed impact is limited to process termination.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NanoSVG is a compact C/C++ SVG parser and rasterizer, and nsvg__addActive() is part of its scanline/active-edge rasterization stage rather than its XML parsing stage. The root cause class is CWE-681 (Incorrect Conversion between Numeric Types): path and geometry coordinates flow into a fixed-point scaled representation, and when the source coordinates are sufficiently large the scaled edge coordinates exceed the range representable by a 32-bit int. The subsequent narrowing conversion to int is performed without range validation, which is undefined behavior in C; on common compilers and platforms this manifests as a wraparound or trap that corrupts the active edge table and can terminate the process. Because the vulnerable arithmetic lives in the rasterizer, an application that only calls the parsing API without invoking rasterization does not reach the affected code path. The supplied CPE data is unpopulated (cpe:2.3:a:n/a:n/a) and EUVD lists affected versions as "n/a n/a", which means there is no authoritative upstream CPE assignment or fixed version boundary; the practical affected set is the NanoSVG source at commit 239e102ec and downstream products vendoring that revision or equivalent code.
Know when Nanosvg gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Untrusted SVG reaching the rasterizer needs no auth or interaction and reliably crashes the process; impact is availability-only, so C:N/I:N/A:H; AV:N assumes the app ingests remote SVG.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in the rasterizer's nsvg__addActive() function. A specially crafted SVG document containing sufficiently large geometry coordinates can cause fixed-point-scaled edge coordinates to exceed the range representable by int. The rasterizer subsequently converts these values to int without range validation, resulting in undefined behavior and possible process termination, leading to denial of service.
Executive ViewAI
A denial-of-service flaw in the NanoSVG rasterization library can allow a single crafted SVG document to crash any application that renders untrusted SVG content. Because NanoSVG is embedded in third-party products rather than deployed on its own, leadership should care about which internal or customer-facing services rely on it and whether an availability outage of those services is tolerable. No vendor patch is currently available, so exposure is managed through configuration and architectural controls rather than remediation.
No vendor-released patch identified at time of analysis. Interim mitigations: disable or restrict rasterization of untrusted/attacker-supplied SVG content; validate and cap input file size and geometry coordinate ranges before rasterization; enforce rasterization timeouts; isolate NanoSVG rasterization in a sandboxed, resource-limited child process with automatic restart to prevent parent-process termination; monitor and alert on anomalous process termination tied to SVG rendering; track upstream GitHub issue 292 for root-cause detail and future fixes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB