GHSA-wq5f-xc86-pv6w
HighSummary
A memory-related vulnerability has been discovered and fixed in the librsvg dependency. Under certain runtime-specific conditions, it can lead to possible remote code execution (RCE) on glibc-based Linux.
Risk Assessment
The vulnerability may allow an attacker to remotely execute code on the system, posing a serious threat to the confidentiality, integrity, and availability of organizational resources.
Recommendation
Update librsvg to a version containing the fix, using prebuilt binaries provided by the vendor or rebuilding the library from the patched source.
Other vulnerabilities in librsvg
See all- CVE-2016-4348High
The _rsvg_css_normalize_font_size function in librsvg 2.40.2 allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via circular definitions in an SVG document.
- CVE-2015-7558High
Librsvg before version 2.40.12 allows context-dependent attackers to cause a denial of service (infinite loop, stack consumption, and application crash) via cyclic references in an SVG document.
- CVE-2015-7557High
The _rsvg_node_poly_build_path function in librsvg before version 2.40.7 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via an odd number of elements in a coordinate pair in an SVG document.
- CVE-2026-96889High
A flaw was found in librsvg where processing an SVG document with nested XML inclusions (Xincludes) and duplicate entity declarations can cause a use-after-free. The library incorrectly frees an XML entity still in use by the parser. An attacker could exploit this to cause a denial of service or execute arbitrary code.
- CVE-2023-38633Medium
A directory traversal issue in the URL decoder of librsvg before version 2.56.3 could be exploited by local or remote attackers to disclose files from the local filesystem outside of the expected area.
Original NVD description (English source)
### Impact A memory-related vulnerability has been discovered and fixed in the upstream librsvg dependency. When certain runtime-specific conditions apply, this vulnerability can lead to possible remote code execution (RCE) on glibc-based Linux. ### Patches #### Using prebuilt binaries provided b
Vulnerability data from NVD (NIST) · CISA KEV · EPSS