NanoSVG’s rasterizer incorrectly converts large geometry coordinates to integer, leading to undefined behavior that can crash the process. This flaw is a numeric conversion error (CWE‑681) and can cause a denial of service when an attacker supplies an SVG containing coordinates that exceed the representable integer range. The attack would terminate the rendering process but does not directly compromise confidentiality or integrity.

The vulnerability affects software that embeds the NanoSVG library (see the project on GitHub). No specific vendor or product version list is provided; the issue was identified in commit 239e102ec and applies to any build that uses that code base without subsequent fixes.

The CVSS score of 7.5 denotes a high severity. EPSS data is unavailable, and the flaw is not currently listed in the CISA KEV catalog, suggesting limited evidence of exploitation. Exploitation would require an application that parses untrusted SVG files; a malicious file could trigger this overflow locally, causing a server or application crash. The risk is therefore primarily for systems that accept arbitrary SVG content.