Use-After-Free in librsvg SVG Parsing via Nested XIncludes and Duplicate Entities
AI analysis
librsvg, the SVG rendering library used widely across Linux desktops and server-side image tooling, contains a use-after-free (CWE-416) flaw in its XML parsing path. The bug is triggered when the library processes an SVG document that uses nested XIncludes combined with duplicate entity declarations, causing it to free an XML entity that the parser is still using. An attacker who convinces a victim to open or process a maliciously crafted SVG file (the CVSS vector is local, user-interaction required) could crash the application for denial of service or potentially achieve arbitrary code execution with the privileges of the parsing process. Because librsvg is a library embedded in many applications—GNOME components, file thumbnailers, and SVG-to-raster conversion services—any application that renders untrusted SVGs is potentially affected. There is no known public proof of concept and no evidence of in-the-wild exploitation as of this analysis.
What to do: Apply distribution security updates for librsvg as soon as patched packages are published by Fedora, Red Hat, Debian, Ubuntu, or your distro vendor, since no fixed upstream version is named in the advisory. Until patched, treat SVG files from untrusted sources as untrusted input—avoid opening them in librsvg-based viewers or thumbnailers, and configure SVG conversion pipelines to reject documents containing XIncludes or complex DTD/entity constructs. Audit services that accept and rasterize user-supplied SVGs, as they are the highest-value targets for this flaw.
Estimated exposure
massTens of millions of devices (librsvg ships by default in GNOME and virtually every major Linux distribution) — librsvg is a core dependency of the GNOME desktop and is packaged in Fedora, RHEL, Debian, Ubuntu, and other major distributions, whose combined desktop and server install base is plausibly in the tens of millions; however, actual…
Description
A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code.