CVE-2015-7557: The _rsvg_node_poly_build_path function in rsvg-shapes.c in librsvg before 2.40.7 allows context-dependent...

Security readout for executives and security teams

CVE-2015-7557 is a denial-of-service issue in librsvg before 2.40.7. A specially formed SVG with an odd coordinate-pair element count can trigger an out-of-bounds heap read during parsing, potentially crashing software that renders the file. Exposure is most likely where servers, desktop components, or applications use librsvg before 2.40.7 to process untrusted SVG files, such as uploads, thumbnails, previews, or document conversion pipelines. Treat as a targeted stability risk for systems that accept SVG content. It is not evidenced as actively exploited here, but exposed image-processing paths should be patched through normal vulnerability remediation timelines. Mitigation focus: Upgrade librsvg to version 2.40.7 or a vendor-fixed later package.; Check operating-system vendor advisories for backported librsvg fixes.; Limit or disable untrusted SVG processing until fixed..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.