CVE-2026-88368: High severity NanoSVG NanoSVG vulnerability
NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in the rasterizer's nsvgaddActive() function. A specially crafted SVG document containing sufficiently large geometry coordinates can cause fixed-point-scaled edge coordinates to exceed the range representable by int. The rasterizer subsequently converts these values to int without range validation, resulting in undefined behavior and possible process termination, leading to denial of service.
Affected Software
Event History
Frequently Asked Questions
What input is required to trigger the issue?
An attacker needs to provide an SVG document with geometry coordinates large enough that fixed-point-scaled edge coordinates exceed the representable int range during rasterization.
What is the practical impact of successful exploitation?
The out-of-range conversion can produce undefined behavior and may terminate the process performing rasterization, resulting in denial of service.
Which code revision is identified as affected?
The issue is identified in NanoSVG commit 239e102ec, specifically in the rasterizer's nsvg__addActive() function.