The vulnerability is an unbounded recursive‑descent parser in RaTeX that recurses one native stack frame per nesting level in LaTeX constructs such as {…}, \left, \sqrt{, ^{, without a depth limit. A short input of about 10 KB containing deep nesting can overflow the 8 MB stack of the main thread and cause the process to abort with SIGABRT. This leads to a fatal, unrecoverable denial of service that can be triggered by any untrusted LaTeX string, giving an attacker control to crash the rendering service or application that uses RaTeX.

The problem affects the RaTeX math rendering engine produced by the erweixin organisation. All releases prior to 0.1.11 are impacted, as the patch was introduced in that version. The vulnerable component is a Rust‑based parser shipped in RaTeX.

The CVSS score of 6.9 indicates a moderate severity, and the vulnerability has no authentication requirement, meaning any user providing input to RaTeX can trigger it. The EPSS score is not available, so the likelihood of exploitation is uncertain, but the low resource requirement and lack of sandbox control make it potentially viable. The issue is not listed in CISA’s KEV catalog.