NanoSVG 239e102ec contains an incorrect numeric conversion flaw during SVG stroke rasterization. A specially crafted SVG file with an extremely large stroke-width triggers floating‑point rounding that produces a zero subdivision angle. The resulting arc division yields an infinite value, which is cast to an integer without range validation, causing undefined behaviour and terminating the process. The weakness reflects improper input validation.

NanoSVG library, commit 239e102ec. No specific version range is listed in the advisory.

The vulnerability is contingent on the application loading the vulnerable SVG image. Attackers can supply the malicious SVG to trigger the crash, potentially from a remote or local context depending on how the library is used. The CVSS score of 6.5 indicates medium severity, and the EPSS score of <1% suggests low exploitation probability; the lack of a KEV listing indicates it has not yet become a widely exploited vulnerability. The primary impact is denial of service through application termination.