CVE-2018-1000041

librsvg: Improper input validation vulnerability in rsvg-io.c

Loading…

Severity

Low

Red Hat Product Security

4.7

CVSS 3.0

Review impact separately from score.

Published · June 7, 2018

Updated · November 22, 2025

Description

GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea contains a Improper input validation vulnerability in rsvg-io.c that can result in the victim's Windows username and NTLM password hash being leaked to remote attackers through SMB. This attack appear to be exploitable via The victim must process a specially crafted SVG file containing an UNC path on Windows.

Statement

The described vulnerability only affects librsvg on Windows, where UNC path references can lead to the NTLM hash being leaked.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.0 · 4.7
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor