CVE-2026-88367

Name of the Vulnerable Software and Affected Versions NanoSVG version 239e102ec

Description An incorrect numeric conversion occurs in the nsvg curveDivs() function during SVG stroke rasterization. When processing a specially crafted SVG document with an extremely large stroke-width, floating-point rounding can result in a zero subdivision angle. This leads to an arc division that yields infinity, which is then converted to an integer without range validation. This sequence causes undefined behavior and process termination, resulting in a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.