erweixin RaTeX up to 0.1.10 Recursive-Descent Parser Cargo.toml stack-based overflow

Summaryinfo

A vulnerability classified as problematic has been found in erweixin RaTeX up to 0.1.10. This affects an unknown part of the file Cargo.toml of the component Recursive-Descent Parser. The manipulation leads to stack-based overflow. This vulnerability is listed as CVE-2026-53531. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in erweixin RaTeX up to 0.1.10. It has been rated as problematic. This issue affects some unknown processing of the file Cargo.toml of the component Recursive-Descent Parser. The manipulation with an unknown input leads to a stack-based overflow vulnerability. Using CWE to declare the problem leads to CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). Impacted is availability. The summary by CVE is:

RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, RaTeX’s recursive-descent parser recurses one (or more) native stack frame per nesting level at `{`, `\left`, `\sqrt{`, `^{`, etc, with no maximum depth limit. A short, ~10 KB input of nested groups overflows the 8 MB main-thread stack and aborts the process. With `panic = "abort"` (`Cargo.toml:48`), and because a Rust stack overflow is always a fatal `SIGABRT` regardless of panic strategy this is an unrecoverable, whole-process denial of service reachable from a single untrusted LaTeX string. Version 0.1.11 fixes the issue.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-53531 since 06/09/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available.

Upgrading to version 0.1.11 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-64180). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• erweixin

Name

• RaTeX

Version

• 0.1.0
• 0.1.1
• 0.1.2
• 0.1.3
• 0.1.4
• 0.1.5
• 0.1.6
• 0.1.7
• 0.1.8
• 0.1.9
• 0.1.10

Website

• Product: https://github.com/erweixin/RaTeX/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion