CVE-2026-53531
The CVE Severity Digest turns the National Vulnerability Database feed into a prioritized security briefing. It groups affected software into practical product families, distinguishes patch and mitigation references from general citations, and ranks the vulnerabilities most likely to matter to technology operators while preserving direct links to the official record.
- CVE
- CVE-2026-53531
- Description
- RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, RaTeX’s recursive-descent parser recurses one (or more) native stack frame per nesting level at `{`, `\left`, `\sqrt{`, `^{`, etc, with no maximum depth limit. A short, ~10 KB input of nested groups overflows the 8 MB main-thread stack and aborts the process. With `panic = "abort"` (`Cargo.toml:48`), and because a Rust stack overflow is always a fatal `SIGABRT` regardless of panic strategy this is an unrecoverable, whole-process denial of service reachable from a single untrusted LaTeX string. Version 0.1.11 fixes the issue.
- Published
- 08/21/2026
- Severity
- MEDIUM
- CVSS
- 6.9
- Priority score
- 55.652