PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9082 Cairographics CVE debrief

CVE-2016-9082 describes a denial-of-service flaw in cairo 1.14.6. A large SVG file can trigger an integer overflow in the write_png function, which may lead to an invalid pointer dereference and application crash. NVD classifies the issue as CWE-190 and rates it Medium.

Vendor
Cairographics
Product
CVE-2016-9082
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-03
Original CVE updated
2026-05-13
Advisory published
2017-02-03
Advisory updated
2026-05-13

Who should care

Organizations using cairo 1.14.6, especially applications and services that render, convert, or otherwise process SVG content from untrusted sources. Teams that embed cairo in document viewers, graphics pipelines, or web-facing file handling workflows should pay attention.

Technical summary

The vulnerability is an integer overflow in cairo’s write_png function. The overflow can be reached through a large SVG file and may result in an invalid pointer dereference, causing denial of service. The NVD record maps the issue to CWE-190 and gives CVSS 3.0 vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, indicating availability impact without confidentiality or integrity impact.

Defensive priority

Medium

Recommended defensive actions

  • Inventory systems and applications using cairo 1.14.6 or downstream packages that include it.
  • Apply vendor or distribution updates referenced in the linked advisories and tracker entries.
  • Restrict or sandbox SVG rendering and conversion paths that accept untrusted input.
  • Add input validation and size/complexity limits for SVG upload and processing workflows.
  • Monitor for crashes or abnormal termination in components that use cairo for image generation or SVG handling.

Evidence notes

This debrief is based on the CVE record, the NVD detail record, and the linked advisories/issues in the supplied corpus. The corpus states the flaw is an integer overflow in write_png in cairo 1.14.6, triggered by a large SVG file, with denial-of-service impact via invalid pointer dereference. NVD identifies CWE-190 and the CVSS 3.0 vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.

Official resources

Public CVE record published on 2017-02-03; NVD metadata was later modified on 2026-05-13. This debrief uses the published CVE timing and the supplied official source corpus only.