CairoSVG contains a defect that allows an attacker to trigger exponential CPU exhaustion by including a recursively referenced <use> element in a crafted SVG file. This flaw is an instance of uncontrolled recursion (CWE-674) combined with resource management weaknesses (CWE-776). When the recursion is processed, the engine repeatedly expands the referenced element, rapidly consuming processing time and memory, which can lead to a denial‑of‑service condition for a server or application that renders the SVG.

The vulnerability exists in the Kozea:CairoSVG library. Version information for affected releases is not explicitly listed in the data; therefore all releases prior to an available fix are considered vulnerable.

The CVSS score of 7.5 reflects a high severity, yet the EPSS score of less than 1% indicates a low probability of widespread exploitation at present. The flaw is not cataloged in CISA's KEV list. Exploitation requires delivery of a specially crafted SVG file that contains the recursive <use> amplification; the attack can be performed remotely if the application processes untrusted SVG input. When triggered, it results in high CPU usage and potential application or service downtime.