CVE-2020-35492

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-03-18 · updated 2026-06-17
Weakness: CWE-121

Description

A flaw was found in cairo's image-compositor.c in all versions prior to 1.17.4. This flaw allows an attacker who can provide a crafted input file to cairo's image-compositor (for example, by convincing a user to open a file in an application using cairo, or if an application uses cairo on untrusted input) to cause a stack buffer overflow -> out-of-bounds WRITE. The highest impact from this vulnerability is to confidentiality, integrity, as well as system availability.

Affected products

Red Hat, Inc. Cairo: before 1.17.4 — fixed in 1.17.4

How to fix

Upgrade to a fixed version: Red Hat, Inc. Cairo 1.17.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-35492 or the next vulnerability affects your stack