CVE-2016-4348: The _rsvg_css_normalize_font_size function in librsvg 2.40.2 allows context-dependent attackers to cause a...

Security readout for executives and security teams

CVE-2016-4348 is a denial-of-service flaw in librsvg 2.40.2. A specially structured SVG with circular definitions can exhaust stack space and crash the application parsing it. The main business risk is service disruption where systems automatically process untrusted SVG files. Exposure is most likely in Linux desktops, servers, or applications using librsvg to render or transform SVGs, especially upload pipelines, thumbnailers, document converters, and image-processing services that accept user-supplied SVG content. Treat this as a targeted availability risk, not a confirmed breach indicator. Patch routinely, but prioritize internet-facing or customer-upload workflows because a crash in shared image processing can affect service reliability. Mitigation focus: Apply vendor security updates for librsvg from supported distributions.; Prioritize systems that process SVG files from users or external sources.; If updates are unavailable, restrict or disable untrusted SVG processing..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.