CVE-2018-25305

librsvg2-bin 2.40.13 Buffer Overflow via Malformed SVG

Published Apr 29, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Description

librsvg2-bin 2.40.13 contains a buffer overflow vulnerability that allows local attackers to cause a denial of service by processing malformed SVG files. Attackers can supply crafted SVG input to the rsvg conversion tool to trigger a segmentation fault in the cairo image compositor.

Analysis

Technical impact

librsvg2-bin 2.40.13 contains a local buffer overflow that causes a segmentation fault when processing specially crafted SVG files. The overflow occurs in the cairo image compositor during SVG conversion, leading to a denial of service for the user running the rsvg command. The vulnerability is a classic stack-based buffer overflow (CWE‑120).

Affected Systems

The affected software is librsvg2-bin version 2.40.13, part of the RSVG image library stack on Linux distributions. Systems that run this binary and allow local users to invoke the rsvg conversion tool are susceptible.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity. No EPSS data is available, and the vulnerability is not documented in the CISA KEV catalog. Attackers would need local access to the system to supply the crafted SVG file; no remote attack vector is described. The risk could be mitigated by ensuring only trusted users have permission to execute the rsvg command and by updating to a version where the buffer overflow has been fixed.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

LibRsvg

librsvg2-bin

unaffected

Version	Status	Constraints
`2.40.13`	affected	—

No data.

Vendor Product Versions

Xenial

Rsvg

Version	Status	Scheme	Platform
`2.40.13`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade librsvg2-bin to the latest available version that contains the fix for this overflow.
Restrict execution of the rsvg conversion tool to trusted users and validate or sanitize SVG input before processing.
Run SVG conversions inside a restricted sandbox or container to limit the impact of a potential crash.

Generated by OpenCVE AI on April 30, 2026 at 13:58 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.118% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://www.exploit-db.com/exploits/44491
https://www.vulncheck.com/advisories/librsvg2-bin-buffer-overflow-via-malformed-svg

History

Apr 30, 2026 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 30, 2026 8:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Xenial Xenial rsvg
Vendors & Products		Xenial Xenial rsvg

Apr 29, 2026 8:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		librsvg2-bin 2.40.13 contains a buffer overflow vulnerability that allows local attackers to cause a denial of service by processing malformed SVG files. Attackers can supply crafted SVG input to the rsvg conversion tool to trigger a segmentation fault in the cairo image compositor.
Title		librsvg2-bin 2.40.13 Buffer Overflow via Malformed SVG
Weaknesses		CWE-120
References		https://www.exploit-db.com/exploits/44491 https://www.vulncheck.com/advisories/librsvg2-bin-buffer-overflow-via-malformed-svg
Metrics		cvssV3_1 `{'score': 6.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`