nanosvg library nanosvg after commit c1f6e209c16b18b46aa9f45d7e619acf42c29726 is affected by: Buffer Overflow. The impact is: Memory…

Description

nanosvg library nanosvg after commit c1f6e209c16b18b46aa9f45d7e619acf42c29726 is affected by: Buffer Overflow. The impact is: Memory corruption leading to at least DoS. More severe impact vectors need more investigation. The component is: it's part of a svg processing library. function nsvg__parseColorRGB in src/nanosvg.h / line 1227. The attack vector is: It depends library usage. If input is passed from the network, then network connectivity is enough. Most likely an attack will require opening a specially crafted .svg file.

Scores

EPSS (exploitation in 30 days)

1.8% · top 22% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.

Weakness

• Buffer Overflow
• CWE-787 (opens in a new tab)All about CWE-787 and its CVEs

Affected products

• nanosvg library · nanosvg

  • affected after commit c1f6e209c16b18b46aa9f45d7e619acf42c29726

References (3)

• https://github.com/memononen/nanosvg/issues/136 (opens in a new tab)x_refsource_MISCx_transferred
• https://0day.work/cve-2019-1000032-memory-corruption-in-nanosvg/ (opens in a new tab)x_refsource_MISCx_transferred
• https://github.com/memononen/nanosvg/ (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2019-1010258](https://trackcve.app/badge/CVE-2019-1010258.svg)](https://trackcve.app/cve/CVE-2019-1010258)

Record last updated 5 Aug 2024, 03:07 UTC.