CairoSVG CVE-2026-107378

Exploitation requires that the target application render attacker-controlled or untrusted SVG input through CairoSVG's svg2png, svg2pdf, or svg2ps APIs on a version prior to 2.9.1; the malicious SVG must contain a path element with a large number of segments to trigger the quadratic tokenizer and the node.vertices.pop(0) draining. No authentication, user interaction, or special configuration is needed (PR:N/UI:N), and the payload can be under one megabyte. The practical limiting factor is exposure: deployments that render only trusted, developer-authored SVGs are not meaningfully at risk, while any service accepting user-uploaded SVGs for conversion is directly exposed.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack requiring no user interaction, with impact confined entirely to availability (VA:H; VC:N/VI:N) - a pure denial-of-service via algorithmic complexity (CWE-407). The base score of 8.7 is driven solely by the ease of reaching the vulnerable code (svg2png/svg2pdf/svg2ps during ordinary rendering) combined with total availability impact, not by any data compromise. No EPSS score, CISA KEV listing, SSVC decision, or public exploit was provided, so there is no evidence of active exploitation or widespread weaponization; this is a high-severity-by-ease issue rather than a confirmed in-the-wild priority. The quadratic behavior is well-documented by the vendor's own fix commits, so the defect is confirmed, but real-world risk depends heavily on whether a given deployment renders untrusted, attacker-supplied SVG input. Note one conflict: the single 'Information Disclosure' tag directly contradicts the CVSS impact metrics (VC:N/VI:N, VA:H) and the DoS description - treat the DoS/availability framing as authoritative.

An application that uses CairoSVG to render user-supplied SVGs (e.g., a document-conversion or thumbnail service) accepts a crafted sub-megabyte SVG containing a path with a very large number of segments. When svg2png/svg2pdf/svg2ps processes it, the path tokenizer's repeated slicing/rescanning and the pop(0) draining of node.vertices trigger quadratic CPU consumption, pinning a core and denying service to legitimate requests. No public exploit code was identified, but the trivial input requirements and vendor-documented root cause make reproduction straightforward.