EUVD-2026-86266
GHSA-p3qg-v7px-94h6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft SVG with huge stroke-width
-
DeliveryDeliver file to victim application
-
ExploitVictim renders SVG in NanoSVG
-
ExecutionInfinity converts to int (UB)
-
ImpactProcess crashes (DoS)
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Exploitation requires the victim to load and stroke-rasterize an attacker-supplied SVG document through NanoSVG (UI:R) - specifically an SVG whose stroke-width is large enough that floating-point rounding collapses the subdivision angle to zero in nsvg__curveDivs(). No authentication or special privileges are needed (PR:N), and no non-default configuration is required beyond the application actually performing stroke rendering (not merely parsing). Limiting factors: user interaction is mandatory (the file must be opened/rendered), impact is a crash of only the embedding process, and the severity of the undefined behavior depends on compiler/runtime hardening (a UBSan or trap-on-overflow build will terminate reliably, whereas an optimized release build may clamp or produce a garbage int without a hard crash). |
| Impact | All exploitability signals point to a low-priority denial-of-service issue despite the 6.5 (Medium) CVSS. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H is network-reachable and unauthenticated, but crucially gated by UI:R - a victim application must actively load/parse the attacker's crafted SVG, so this is not a server-side auto-triggered flaw. Impact is confined to availability (C:N/I:N/A:H): a float-to-int conversion of an infinity value (CWE-681) produces undefined behavior and process termination - a crash, not code execution or data exposure. EPSS is only 0.15% (3rd percentile), there is no CISA KEV listing, and no public exploit code is identified (the sole reference is a GitHub issue report, not a weaponized PoC). Note the A:H rating is arguably generous: the outcome is a single-process crash of whatever host application embeds NanoSVG, not sustained service-wide unavailability, and on non-UBSan/hardened builds the out-of-range int conversion may be silently clamped rather than fatal. There is no conflict between CVSS and description - both agree on remote-delivered but interaction-gated DoS. Net: a real but minor robustness bug, not an urgent priority. |
| Exploit ScenarioDerived | An attacker crafts an SVG file with an extremely large stroke-width value and delivers it to a victim (via a website, email attachment, or file share) that uses an application embedding NanoSVG. When the victim opens or renders the file, nsvg__curveDivs() computes a zero subdivision angle, the arc division yields infinity, and converting that to int triggers undefined behavior that terminates the process. No public exploit code is identified at time of analysis - only an upstream GitHub issue report exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
NanoSVG (memononen/nanosvg, revision 239e102ec) can be crashed by an SVG document whose stroke-width is large enough that floating-point rounding collapses the subdivision angle computed in nsvg__curveDivs() to zero, producing an infinite arc-division value that is converted to int without range validation (CWE-681). The result is undefined behavior that reliably terminates the process on hardening or trap-on-overflow builds, so applications that stroke-rasterize untrusted SVGs suffer a denial of service; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (6.5 Medium) means no authentication is required but the victim must open and render the crafted file. Exploitation signals are weak: EPSS is only 0.15% (3rd percentile), no CISA KEV entry exists, and no public exploit code has been identified at time of analysis, and impact is confined to a crash of the embedding process rather than code execution or data compromise.
RemediationAI
No vendor-released patch has been identified at time of analysis, and no fixed version is stated in the available data; the upstream NanoSVG issue (https://github.com/memononen/nanosvg/issues/293) is the place to track a proper fix, which should clamp or validate the divisors computed in nsvg__curveDivs() and reject non-finite results before the int conversion. Until that lands, the most effective compensating control is to sanitize or reject SVG input before rendering: cap the accepted stroke-width (for example, discard or clamp values above a few thousand user units) and drop documents whose computed geometry yields non-finite values - the trade-off is that legitimate but unusually large-stroke artwork will render incorrectly or be refused. Applications that do not need vector stroke rendering can disable the stroke rasterization path entirely or fall back to parsing only, which removes the vulnerable code from the attack surface at the cost of losing visual fidelity. Because the crash occurs inside the host process, isolate SVG rendering in a separate sandboxed worker or child process with a watchdog and memory/CPU limits so a termination does not take down the parent service; this adds IPC complexity and latency but bounds the blast radius. Where feasible, build with UBSan or trap-on-overflow enabled in test and staged environments to detect the fault early, and prefer hardened builds in production so the undefined behavior fails deterministically rather than silently producing corrupted geometry. Finally, treat SVG uploads as untrusted input: restrict who can supply files, scan them with format-aware tooling, and monitor for repeated renderer crashes as an indicator of attempted exploitation. References for tracking: https://github.com/memononen/nanosvg/issues/293 and https://nvd.nist.gov/vuln/detail/CVE-2026-88367.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NanoSVG is a small single-header C/C++ SVG parsing and rasterization library used to embed SVG rendering in applications; the fault lies in the stroke rendering path, specifically nsvg__curveDivs(), which decides how many line segments approximate a curve or arc. When the requested stroke-width is extremely large, floating-point rounding in the subdivision-angle calculation can underflow to exactly zero, after which the arc division produces infinity; that floating-point value is then converted to an integer without bounds or domain checking, which falls squarely into CWE-681 (Incorrect Conversion between Numeric Types) and is undefined behavior in C. The trigger is not simple parsing but stroke rasterization of the malformed geometry, so only code paths that actually render strokes with NanoSVG are exposed; whether the outcome is a deterministic crash depends on compiler and runtime hardening, since optimized release builds may clamp or yield a garbage int while UBSan or trap-on-overflow instrumentation terminates immediately. No CPE mapping was supplied for this record (the vendor/product fields are n/a), so affected scope must be inferred from the NanoSVG source revision rather than an authoritative product enumeration.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Remote crafted file delivered to a rendering victim gives AV:N/AC:L/PR:N/UI:R; impact is a process-terminating crash only, so C:N/I:N/A:H and no scope change.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
NanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__curveDivs() during SVG stroke rasterization. A specially crafted SVG document containing an extremely large stroke-width can cause floating-point rounding to produce a zero subdivision angle. The subsequent arc division yields infinity, which is converted to int without range validation, resulting in undefined behavior and process termination, leading to denial of service.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB