CVE-2026-88367 in NanoSVG
Summary
by MITRE • 09/24/2026
NanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__curveDivs() during SVG stroke rasterization. A specially crafted SVG document containing an extremely large stroke-width can cause floating-point rounding to produce a zero subdivision angle. The subsequent arc division yields infinity, which is converted to int without range validation, resulting in undefined behavior and process termination, leading to denial of service.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified as CVE-2018-239e102ec resides within the NanoSVG library, specifically affecting the nsvg__curveDivs function which is responsible for calculating subdivision counts during SVG stroke rasterization. This component plays a critical role in converting vector-based Scalable Vector Graphics into pixel data by breaking down complex curves and arcs into manageable line segments. The core technical flaw stems from an incorrect numeric conversion that occurs when processing documents with extreme attribute values, particularly those specifying an excessively large stroke-width parameter. When the library attempts to compute the necessary subdivisions for rendering these strokes, it relies on floating-point arithmetic to determine a subdivision angle based on geometric properties and the specified width.
Under normal circumstances, this calculation yields reasonable integer values that allow for smooth curve approximation. However, when presented with a specially crafted SVG document containing an extremely large stroke-width value, the intermediate floating-point calculations can result in rounding errors that produce a zero or near-zero subdivision angle. This mathematical anomaly triggers a subsequent division operation where infinity is generated as a result of dividing by this negligible value. The critical failure point occurs during the type casting process, where this infinite float value is converted directly to an integer without any range validation or boundary checking mechanisms in place.
This lack of input sanitization leads to undefined behavior within the application utilizing NanoSVG. In most practical implementations, attempting to use such a corrupted integer value for array indexing, loop control, or memory allocation results in immediate process termination. This manifests as a denial of service condition where the rendering engine crashes unexpectedly upon encountering the malicious payload. The impact is significant because it allows an attacker who can influence SVG input data to disrupt availability by causing application crashes without requiring any form of authentication or privilege escalation.
From a classification perspective, this vulnerability aligns with CWE-190 Integer Overflow or Wraparound and CWE-369 Divide By Zero, as the root cause involves improper handling of numeric values leading to invalid arithmetic operations. In terms of attack vectors, it falls under ATT&CK technique T1496 Resource Hijacking via Denial of Service, specifically targeting application availability through resource exhaustion caused by crash-inducing inputs. The vulnerability highlights a common pitfall in graphics processing libraries where performance optimizations often bypass rigorous input validation steps that are typically found in more security-focused software development lifecycles.
Mitigation strategies for this issue involve implementing robust range checking before performing arithmetic operations on user-supplied values derived from SVG attributes. Developers should validate stroke-width and other dimensional parameters to ensure they remain within expected bounds prior to being passed into rasterization functions. Additionally, incorporating defensive programming practices such as explicit checks for infinity or NaN results after floating-point calculations can prevent the propagation of invalid states. Updating NanoSVG to patched versions that include these validation layers is essential for systems relying on this library for rendering untrusted SVG content. Security teams should also consider implementing sandboxing mechanisms to isolate graphics processing tasks, thereby limiting the blast radius if a crash occurs due to malformed input data.