CVE-2026-53530
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
RaTeX prior to version 0.1.11 panics on the 9-byte input \verbéxé because the parser slices the verbatim argument with byte indices, and index 1 lands inside a multibyte UTF-8 character. Since the release profile sets panic = "abort", the panic aborts the entire process, causing a hard denial of service. Version 0.1.11 fixes the issue.
Risk Assessment
An attacker could send crafted input causing the entire process to crash, leading to unavailability of the rendering service.
Recommendation
Upgrade RaTeX to version 0.1.11 or later to prevent panics on multibyte characters.
Other vulnerabilities in RaTeX
Original NVD description (English source)
RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, the public parser entrypoint `ratex_parser::parse(&str)` panics on the 9-byte input `\verbéxé` (i.e. `\verb` followed by the non-ASCII delimiter `é`). When handling a `\verb` command, the parser slices the verbatim argument with byte indices (`arg[1..arg.len() - 1]`); if the delimiter character is multibyte UTF-8, index `1` lands inside that character and Rust panics with *“byte index 1 is not a char boundary”*. Because RaTeX’s release profile sets `panic = "abort"` (`Cargo.toml:48`), the panic aborts the entire process — not just the current request/thread — making this a hard denial of service for any service that renders untrusted LaTeX. Version 0.1.11 fixes the issue.