CVE-2026-88366 Integer overflow in n/a
A crafted SVG document can cause a crash in NanoSVG due to unsafe numeric conversion, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-88366?
CVE-2026-88366 is a high-severity vulnerability in n/a, published on 24 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__pathArcTo() when parsing SVG arc commands. A specially crafted SVG document containing extreme arc radius values can cause intermediate arc calculations to produce a NaN delta angle. The function subsequently converts this NaN value to int without validating that it is finite and representable, resulting in undefined behavior and process termination, leading to denial of service.
Weakness: CWE-681
Which versions are affected by CVE-2026-88366?
How do I fix CVE-2026-88366?
No fix has been published for CVE-2026-88366 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-88366 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-88366 exists.
Sources
Also known as GHSA-7hmh-4252-97cx, UBUNTU-CVE-2026-88366.