CVE-2023-51885 is a buffer overflow in Mathtex 1.05 and earlier, triggered by the length of the LaTeX string. The record says a remote attacker can execute arbitrary code and rates it Critical at 9.8. No fixed version is named, so remove or isolate the program.
What's affected
Mathtex 1.05 and earlier, a CGI program that renders LaTeX into images for web pages. The record gives no fixed version, and the write-up we read tests against 1.05 and earlier without naming a patched release. Check the project's current release and your package source.
Mathtex is distributed through CTAN and is often copied by hand into a server, so the copy you run may not match any release. Six CVEs were reported against it from one fuzzing session in December 2023, and all of them name 1.05 and earlier. The record for each lists the CTAN mathtex product with no version bound, so treat every version you find as in scope until the maintainers say otherwise.
The record gives a CVSS score of 9.8 (Critical). The CVSS vector reads as follows. The attack can be reached over the network, and the complexity is low. No account is needed. No user interaction is required. Impact on confidentiality is high, on integrity high, and on availability high. The weakness class is CWE-120.
How to check if you're exposed
Find out whether mathtex is installed. On a server, find / -name 'mathtex*' 2>/dev/null lists copies. A web server configuration that maps a cgi-bin path to mathtex.cgi also shows it. Then read the version in the source or documentation for your copy.
If the program is reachable from the internet, treat it as exposed. Most uses are old wiki or forum add-ons that nobody remembers.
Your dependency scanner will not see a copy of a CGI program dropped into a directory. A file system search, plus a review of web server configuration, is the dependable way to find it. You can also scan the application that embeds it with the free in-browser scan at https://gold.safeguard.sh/scan to catch the packaged components around it.
What to do now
- Find mathtex installs, including old wiki or forum add-ons.
- Check for a newer release, and update if one exists.
- Remove the program, or move math rendering to a maintained tool, if you cannot update.
- Do not expose it to the internet. Put it behind authentication or a reverse proxy that limits request size.
- Run it as an unprivileged account with no write access beyond its cache directory.
Why it matters
The weakness is a classic buffer overflow, CWE-120. The program copies the input into a fixed size buffer without checking length. The researcher's fuzzing write-up reports that very long input overflows buffers in command line mode, and in CGI mode when the web server accepts very long URLs.
A web server's maximum URL length matters for exposure, since it limits how long a request can be. The write-up ties the CGI case to that limit. A tight limit helps, but it is not a fix.
This is one of six CVEs reported against the same program from one fuzzing session. If you run it, treat them as a group.
Quick check
Is it exploitable over the web?
The record says remote. The write-up says CGI mode is affected when the server accepts very long URLs.
Is there a patched release?
None is named in the record or the write-up.
Sources
Last reviewed: 19 October 2026.
