EUVD-2026-86267

NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in the rasterizer's nsvgaddActive function. A specially crafted SVG document containing sufficiently large geometry coordinates can cause fixed-point-scaled edge coordinates to exceed the range representable by int. T...

CVE-2026-88366

NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in nsvgpathArcTo when parsing SVG arc commands. A specially crafted SVG document containing extreme arc radius values can cause intermediate arc calculations to produce a NaN delta angle. The function subsequently...

EUVD-2026-86266

NanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvgcurveDivs during SVG stroke rasterization. A specially crafted SVG document containing an extremely large stroke-width can cause floating-point rounding to produce a zero subdivision angle. The subsequent arc division...

CVE-2026-88367

NanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvgcurveDivs during SVG stroke rasterization. A specially crafted SVG document containing an extremely large stroke-width can cause floating-point rounding to produce a zero subdivision angle. The subsequent arc division...

CVE-2026-88367

NanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvgcurveDivs during SVG stroke rasterization. A specially crafted SVG document containing an extremely large stroke-width can cause floating-point rounding to produce a zero subdivision angle. The subsequent arc division...

CVE-2026-88367

NanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvgcurveDivs during SVG stroke rasterization. A specially crafted SVG document containing an extremely large stroke-width can cause floating-point rounding to produce a zero subdivision angle. The subsequent arc division...

CVE-2026-88368: Incorrect Conversion between Numeric Types

NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in the rasterizer's nsvgaddActive function. A specially crafted SVG document containing sufficiently large geometry coordinates can cause fixed-point-scaled edge coordinates to exceed the range representable by int. T...

CVE-2026-88387

LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::parsetiffifd when processing TIFF tag 0x00fe NewSubfileType. A specially crafted RAW, TIFF, or DNG file can supply an attacker-controlled NewSubfileType value outside the range of a signed int. The parser converts thi...

CVE-2026-88367

The NanoSVG 239e102ec library is vulnerable to an incorrect numeric conversion within the nsvg__curveDivs() function during SVG stroke rasterization. A specially crafted SVG document with an excessively large stroke-width can trigger floating-point rounding that produces a zero subdivision angle....

CVE-2026-88368

NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in the rasterizer's nsvgaddActive function. A specially crafted SVG document containing sufficiently large geometry coordinates can cause fixed-point-scaled edge coordinates to exceed the range representable by int. T...

CVE-2026-88368

NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in the rasterizer's nsvgaddActive function. A specially crafted SVG document containing sufficiently large geometry coordinates can cause fixed-point-scaled edge coordinates to exceed the range representable by int. T...

CVE-2026-88368

NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in the rasterizer's nsvgaddActive function. A specially crafted SVG document containing sufficiently large geometry coordinates can cause fixed-point-scaled edge coordinates to exceed the range representable by int. T...

CVE-2026-88367: Incorrect Conversion between Numeric Types

NanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvgcurveDivs during SVG stroke rasterization. A specially crafted SVG document containing an extremely large stroke-width can cause floating-point rounding to produce a zero subdivision angle. The subsequent arc division...

CVE-2026-88362

MuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsRisindex in jsrun.c. A specially crafted JavaScript input containing an excessively large numeric array index can cause an out-of-range floating-point value to be converted to an integer without proper range validation. Th...

CVE-2026-88366

NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in nsvgpathArcTo when parsing SVG arc commands. A specially crafted SVG document containing extreme arc radius values can cause intermediate arc calculations to produce a NaN delta angle. The function subsequently...

PT-2026-97925

Name of the Vulnerable Software and Affected Versions NanoSVG version 239e102ec Description An incorrect numeric conversion occurs in the nsvg curveDivs function during SVG stroke rasterization. When processing a specially crafted SVG document with an extremely large stroke-width, floating-point...

PT-2026-97868

Name of the Vulnerable Software and Affected Versions NanoSVG versions prior to commit 239e102ec Description An incorrect numeric conversion occurs in the nsvg pathArcTo function when parsing SVG arc commands. A specially crafted SVG document with extreme arc radius values can cause intermediate...

PT-2026-97869

Name of the Vulnerable Software and Affected Versions NanoSVG affected versions not specified Description An incorrect numeric conversion occurs in the rasterizer's nsvg addActive function. A specially crafted SVG document with excessively large geometry coordinates can cause fixed-point-scaled...

CVE-2026-88362

MuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsRisindex in jsrun.c. A specially crafted JavaScript input containing an excessively large numeric array index can cause an out-of-range floating-point value to be converted to an integer without proper range validation. Th...

CVE-2026-88362

MuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsRisindex in jsrun.c. A specially crafted JavaScript input containing an excessively large numeric array index can cause an out-of-range floating-point value to be converted to an integer without proper range validation. Th...