erweixin RaTeX up to 0.1.10 Recursive-Descent Parser Cargo.toml stack-based overflow

Summaryinfo

A vulnerability classified as problematic has been found in erweixin RaTeX up to 0.1.10. This affects an unknown part of the file Cargo.toml of the component Recursive-Descent Parser. The manipulation leads to stack-based overflow. This vulnerability is listed as CVE-2026-53531. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in erweixin RaTeX up to 0.1.10. It has been rated as problematic. This issue affects some unknown processing of the file Cargo.toml of the component Recursive-Descent Parser. The manipulation with an unknown input leads to a stack-based overflow vulnerability. Using CWE to declare the problem leads to CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). Impacted is availability. The summary by CVE is:

RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, RaTeX’s recursive-descent parser recurses one (or more) native stack frame per nesting level at `{`, `\left`, `\sqrt{`, `^{`, etc, with no maximum depth limit. A short, ~10 KB input of nested groups overflows the 8 MB main-thread stack and aborts the process. With `panic = "abort"` (`Cargo.toml:48`), and because a Rust stack overflow is always a fatal `SIGABRT` regardless of panic strategy this is an unrecoverable, whole-process denial of service reachable from a single untrusted LaTeX string. Version 0.1.11 fixes the issue.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-53531 since 06/09/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available.

Upgrading to version 0.1.11 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• erweixin

Name

• RaTeX

Version

• 0.1.0
• 0.1.1
• 0.1.2
• 0.1.3
• 0.1.4
• 0.1.5
• 0.1.6
• 0.1.7
• 0.1.8
• 0.1.9
• 0.1.10

Website

• Product: https://github.com/erweixin/RaTeX/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion