vulnti.work

NanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__curveDivs() during SVG stroke rasterization. A specially crafted SVG document containing an extremely large stroke-wi…

中危 CVSS 6.5
CVECVE-2026-88367
首次发现2026-09-25 19:16 UTC
披露时间2026-09-24 17:17 UTC
最后更新2026-09-25 19:16 UTC
通道状态auto

摘要

NanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__curveDivs() during SVG stroke rasterization. A specially crafted SVG document containing an extremely large stroke-width can cause floating-point rounding to produce a zero subdivision angle. The subsequent arc division yields infinity, which is converted to int without range validation, resulting in undefined behavior and process termination, leading to denial of service.

中文摘要建设中,暂以英文摘要呈现(DR-003 v2)。

深度研判

该漏洞尚未生成深度研判报告(DR-003 v2 AI pipeline 建设中)。

数据来源

  • NVD DATABASE

原始链接

时间线

  1. nvd_ingest NVD