CVE-2026-88355 in tinyexpr
Summary
by MITRE • 09/24/2026
An incorrect buffer size calculation vulnerability exists in tinyexpr commit 4a7456e in new_expr(). For arity-0 expression nodes, including constants, variables, and zero-argument functions, the function allocates less memory than sizeof(te_expr) but treats the returned allocation as a complete te_expr object. This results in undefined behavior and can cause deterministic process termination in UBSan-instrumented builds.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified within the tinyexpr library, specifically introduced or present in commit 4a7456e during the execution of the new_expr function, represents a critical memory management flaw rooted in incorrect buffer size calculation. This issue primarily affects arity-0 expression nodes, which encompass constants, variables, and functions that require no arguments. In these specific cases, the allocation logic fails to account for the full structural requirements of the te_expr object, resulting in a heap-based buffer under-allocation where significantly less memory is reserved than what sizeof(te_expr) dictates.
From a technical perspective, this flaw constitutes an out-of-bounds write vulnerability because the code proceeds to treat the undersized allocation as if it were a complete and valid te_expr structure. When subsequent operations attempt to initialize or access fields within this object, they inevitably write beyond the boundaries of the allocated memory block. This behavior triggers undefined behavior according to standard C programming guidelines, leading to potential data corruption, stack smashing, or immediate process termination when detected by sanitizers such as UndefinedBehaviorSanitizer in instrumented builds. The deterministic nature of the crash indicates that the vulnerability is reliably exploitable under specific conditions where these zero-argument nodes are processed.
The operational impact of this vulnerability extends beyond simple application crashes. In environments where tinyexpr is integrated into larger systems or services, an attacker could potentially leverage this memory corruption to achieve arbitrary code execution if they can control the input expressions that trigger the allocation path. Even without remote exploitation capabilities, the reliability of applications relying on precise mathematical evaluation for critical operations may be compromised due to unpredictable state changes caused by heap metadata corruption or adjacent variable overwrites.
This vulnerability aligns with CWE-131, which describes incorrect calculation of buffer size, and falls under the broader category of memory safety violations often associated with CWE-787 out-of-bounds write vulnerabilities. In terms of adversarial tactics, this flaw could be categorized within MITRE ATT&CK techniques related to initial access or execution via exploited client-side components if tinyexpr is used in a context where user-supplied expressions are parsed without adequate validation.
To mitigate this risk, developers must immediately patch the new_expr function to ensure that memory allocation strictly matches the size of the te_expr structure for all node types, including arity-0 nodes. Implementing rigorous bounds checking and utilizing static analysis tools capable of detecting buffer overflows during development is essential. Furthermore, integrating fuzz testing into the continuous integration pipeline can help identify similar edge cases in expression parsing logic before deployment to production environments.