CVE-2026-88355: Tinyexpr vulnerability
An incorrect buffer size calculation vulnerability exists in tinyexpr commit 4a7456e in newexpr(). For arity-0 expression nodes, including constants, variables, and zero-argument functions, the function allocates less memory than sizeof(teexpr) but treats the returned allocation as a complete teexpr object. This results in undefined behavior and can cause deterministic process termination in UBSan-instrumented builds.
Affected Software
Event History
Frequently Asked Questions
Which uses are exposed to the reported process termination?
Uses of tinyexpr built with UBSan instrumentation are specifically reported to experience deterministic process termination when arity-0 expression nodes are created. These nodes include constants, variables, and zero-argument functions.
What conditions are needed to trigger the issue?
The vulnerable code path is new_expr() handling an arity-0 expression node. No attacker access level, input delivery mechanism, or remote exploit scenario is provided in the available data.
How can I determine whether my build is affected?
Check whether the tinyexpr source includes commit 4a7456e and whether new_expr() allocates arity-0 nodes with a size smaller than sizeof(te_expr). UBSan-instrumented builds that create constants, variables, or zero-argument functions are the reported observable failure case.