CVE-2026-88368 Integer overflow in n/a
A specially crafted SVG document can cause an integer overflow in NanoSVG, leading to process termination and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-88368?
CVE-2026-88368 is a high-severity vulnerability in n/a, published on 24 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in the rasterizer's nsvg__addActive() function. A specially crafted SVG document containing sufficiently large geometry coordinates can cause fixed-point-scaled edge coordinates to exceed the range representable by int. The rasterizer subsequently converts these values to int without range validation, resulting in undefined behavior and possible process termination, leading to denial of service.
Weakness: CWE-681
Which versions are affected by CVE-2026-88368?
How do I fix CVE-2026-88368?
No fix has been published for CVE-2026-88368 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-88368 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-88368 exists.
Sources
Also known as GHSA-p7cc-752h-fv9q, UBUNTU-CVE-2026-88368.