CVE-2026-88366
Description
A flaw was found in NanoSVG. An attacker could exploit this vulnerability by providing a specially crafted Scalable Vector Graphics (SVG) file containing extreme arc radius values. Improper numeric conversion during arc calculations causes the parser to process invalid values without appropriate validation, triggering unexpected process termination and leading to a Denial of Service (DoS).
Statement
This vulnerability is rated as having Moderate impact because exploitation requires user interaction to process an untrusted vector graphics file, and the resulting impact is strictly confined to application termination (denial of service) without enabling code execution or data disclosure. Red Hat enterprise products do not ship or expose NanoSVG as a core system daemon, restricting potential exposure to standalone or developer applications handling untrusted inputs. Under standard configurations, the blast radius is limited entirely to the specific process handling the file.
Understanding the Weakness (CWE)
Other,Integrity
Technical Impact: Unexpected State; Quality Degradation
The program could wind up using the wrong number and generate incorrect results. If the number is used to allocate resources or make a security decision, then this could introduce a vulnerability.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
