CyberRota Analysis
AI-GeneratedA vulnerability exists in the rasterizer's nsvg__addActive() function of NanoSVG, where improper numeric conversion can occur due to large geometry coordinates in specially crafted SVG documents. This flaw allows for fixed-point-scaled edge coordinates to exceed the representable range of integers, potentially leading to undefined behavior and denial of service through process termination. Developers and security teams utilizing NanoSVG in their applications should prioritize addressing this issue to mitigate risks associated with SVG processing.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in the rasterizer's nsvg__addActive() function. A specially crafted SVG document containing sufficiently large geometry coordinates can cause fixed-point-scaled edge coordinates to exceed the range representable by int. The rasterizer subsequently converts these values to int without range validation, resulting in undefined behavior and possible process termination, leading to denial of service.