CVE-2026-88368
Description
A flaw was found in NanoSVG. An attacker could exploit an incorrect numeric conversion vulnerability in the rasterizer by providing a specially crafted Scalable Vector Graphics (SVG) document with excessively large geometry coordinates. When processed, these coordinates exceed integer boundaries without validation, causing application crash and resulting in a Denial of Service (DoS).
Statement
This vulnerability is rated as Moderate impact because exploitation necessitates processing an untrusted SVG file, and the failure mode is restricted to an application crash without threatening system confidentiality or integrity. NanoSVG functions as an embedded rendering library within graphical and desktop tools rather than critical network services in Red Hat enterprise environments. As a result, any denial of service is localized to the specific user process handling the malicious vector graphic.
Understanding the Weakness (CWE)
Other,Integrity
Technical Impact: Unexpected State; Quality Degradation
The program could wind up using the wrong number and generate incorrect results. If the number is used to allocate resources or make a security decision, then this could introduce a vulnerability.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
