NanoSVG commit 239e102ec contains an incorrect numeric conversion in the nsvg__pathArcTo() function. When an SVG file uses extreme arc radius values, the internal calculation can produce a NaN delta angle. The function then casts this NaN to an int without validation, causing undefined behavior and terminating the process, which results in a denial‑of‑service condition.

The vulnerability resides in the NanoSVG library itself. Any software that incorporates NanoSVG to render SVG content—whether for desktop, mobile, or embedded devices—may be affected if it includes this buggy commit. Exact vendor or product information is not provided, so the impact is inferred to be widespread across any host that uses the affected version of the library.

The CVSS score of 7.5 indicates a high severity issue. The EPSS score of less than 1% shows that exploitation is unlikely but not impossible, and the vulnerability is not listed in the CISA KEV catalog. Attackers can deliver malicious SVG documents that trigger the crash from a remote source if the application accepts SVG input over the network, or locally if they can influence local file usage. The crash leads to process termination and loss of availability for the affected application.