Description
RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, the public parser entrypoint `ratex_parser::parse(&str)` panics on the 9-byte input `\verbéxé` (i.e. `\verb` followed by the non-ASCII delimiter `é`). When handling a `\verb` command, the parser slices the verbatim argument with byte indices (`arg[1..arg.len() - 1]`); if the delimiter character is multibyte UTF-8, index `1` lands inside that character and Rust panics with *“byte index 1 is not a char boundary”*. Because RaTeX’s release profile sets `panic = "abort"` (`Cargo.toml:48`), the panic aborts the entire process — not just the current request/thread — making this a hard denial of service for any service that renders untrusted LaTeX. Version 0.1.11 fixes the issue.
Published: 2026-08-21
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via process abort
Action: Immediate Patch
AI Analysis

Impact

The RaTeX parser panics when processing a \verb command that uses a multibyte UTF‑8 delimiter, such as \verbéxé. The parser slice is performed on byte indices, causing a panic on byte index 1 that is not a character boundary. Because the library builds with the configuration panic = "abort", the panic terminates the entire process rather than just the request thread. The result is a hard denial of service for any service that accepts untrusted LaTeX input. The vulnerability has a CVSS score of 8.7 and is not listed in the CISA KEV catalog.

Affected Systems

The affected product is RaTeX from the vendor erweixin. Versions prior to 0.1.11 are vulnerable; RaTeX 0.1.11 and newer contain the fix.

Risk and Exploitability

The risk is significant with a CVSS score of 8.7. The EPSS score is not available, so the current exploitation probability is unknown, but the lack of a KEV listing does not mitigate the impact. Based on the description, the likely attack vector is a remote attacker submitting crafted LaTeX containing a multibyte delimiter to a service that processes LaTeX via RaTeX. The adversary can cause the service to crash, effectively denying service to all users. Due to the panic=abort configuration, any crash aborts the process, making mitigation via recovery code in user land impossible.

Generated by OpenCVE AI on August 21, 2026 at 22:38 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update RaTeX to version 0.1.11 or later. This version removes the unsafe slicing and eliminates the panic.
  • Run RaTeX rendering in a separate process or container and restart it automatically on crash. This containment strategy prevents a single panic from bringing down the entire application.
  • Modify the application's Rust build settings to use panic="unwind" instead of panic="abort" and add appropriate panic handling logic to catch and recover from crashes. This reduces the impact of future panics but still requires careful handling of untrusted input.

Generated by OpenCVE AI on August 21, 2026 at 22:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-4hgp-59h5-gvrj ratex-parser panics on `\verb` with a multibyte delimiter (UTF-8 byte-boundary slice)
History

Mon, 24 Aug 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 23 Aug 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Erweixin
Erweixin ratex
Vendors & Products Erweixin
Erweixin ratex

Fri, 21 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
Description RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, the public parser entrypoint `ratex_parser::parse(&str)` panics on the 9-byte input `\verbéxé` (i.e. `\verb` followed by the non-ASCII delimiter `é`). When handling a `\verb` command, the parser slices the verbatim argument with byte indices (`arg[1..arg.len() - 1]`); if the delimiter character is multibyte UTF-8, index `1` lands inside that character and Rust panics with *“byte index 1 is not a char boundary”*. Because RaTeX’s release profile sets `panic = "abort"` (`Cargo.toml:48`), the panic aborts the entire process — not just the current request/thread — making this a hard denial of service for any service that renders untrusted LaTeX. Version 0.1.11 fixes the issue.
Title ratex-parser panics on `\verb` with a multibyte delimiter (UTF-8 byte-boundary slice)
Weaknesses CWE-1285
CWE-248
CWE-400
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Erweixin Ratex
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-24T20:05:00.628Z

Reserved: 2026-06-09T17:30:33.457Z

Link: CVE-2026-53530

cve-icon Vulnrichment

Updated: 2026-08-24T20:04:37.162Z

cve-icon NVD

Status : Deferred

Published: 2026-08-21T22:16:39.590

Modified: 2026-09-09T21:06:39.057

Link: CVE-2026-53530

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-23T16:40:22Z

Weaknesses
  • CWE-1285

    Improper Validation of Specified Index, Position, or Offset in Input

  • CWE-248

    Uncaught Exception

  • CWE-400

    Uncontrolled Resource Consumption