CVE-2026-53530

Name of the Vulnerable Software and Affected Versions RaTeX versions prior to 0.1.11

Description The public parser entrypoint ratex parser::parse(&str) contains a flaw that causes the application to panic when processing a verb command followed by a non-ASCII multibyte UTF-8 delimiter, such as verbéxé. The issue occurs because the parser uses byte indices instead of character boundaries when slicing the verbatim argument in the parse symbol inner() function. Specifically, if the delimiter is a multibyte character, the slice operation starts inside the character, triggering a Rust panic. Since the release profile is configured to abort on panic, the entire process is terminated, leading to a denial of service for any service rendering untrusted LaTeX.

Recommendations Update RaTeX to version 0.1.11.