CVE-2023-51886: High Mathtex convertpath Buffer Overflow DoS

CVE-2023-51886 is a buffer overflow in the main function of Mathtex 1.05 and earlier when the convertpath directive is used. The record says it causes denial of service and rates it High at 7.5. No fixed version is named.

What's affected

Mathtex 1.05 and earlier, a CGI program that renders LaTeX into images for web pages. The record gives no fixed version, and the write-up we read tests against 1.05 and earlier without naming a patched release. Check the project's current release and your package source.

Mathtex is distributed through CTAN and is often copied by hand into a server, so the copy you run may not match any release. Six CVEs were reported against it from one fuzzing session in December 2023, and all of them name 1.05 and earlier. The record for each lists the CTAN mathtex product with no version bound, so treat every version you find as in scope until the maintainers say otherwise.

The record gives a CVSS score of 7.5 (High). The CVSS vector reads as follows. The attack can be reached over the network, and the complexity is low. No account is needed. No user interaction is required. Impact on confidentiality is none, on integrity none, and on availability high. The weakness class is CWE-120.

How to check if you're exposed

Find out whether mathtex is installed. On a server, find / -name 'mathtex*' 2>/dev/null lists copies. A web server configuration that maps a cgi-bin path to mathtex.cgi also shows it. Then read the version in the source or documentation for your copy.

If the program is reachable from the internet, treat it as exposed. Most uses are old wiki or forum add-ons that nobody remembers.

Your dependency scanner will not see a copy of a CGI program dropped into a directory. A file system search, plus a review of web server configuration, is the dependable way to find it. You can also scan the application that embeds it with the free in-browser scan at https://gold.safeguard.sh/scan to catch the packaged components around it.

What to do now

1. Find mathtex installs, including old wiki or forum add-ons.
2. Check for a newer release, and update if one exists.
3. Remove the program, or move math rendering to a maintained tool, if you cannot update.
4. Do not expose it to the internet. Put it behind authentication or a reverse proxy that limits request size.
5. Run it as an unprivileged account with no write access beyond its cache directory.

Why it matters

The weakness is a buffer overflow, CWE-120, in handling of the convertpath directive. The write-up reports a global buffer overflow, meaning a fixed size global variable is overrun when the value is too long.

The record's impact is availability only, so the result is a crash. A CGI that crashes on every bad request is easy to knock offline, and it may leave partial files behind.

Because mathtex is rarely updated, the safest path is to remove it or to put it behind controls that limit input size.

Quick check

Sources

• Fuzzing mathtex write-up

Last reviewed: 19 October 2026.