Reachable assertion in Cairo - CVE-2025-50422

Vulnerability identifier: #VU116114

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-50422

CWE-ID: CWE-617

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion within the _cairo_ft_unscaled_font_fini() function in cairo-ft-font.c. A remote attacker can trick the victim into opening a specially crafted file and crash the application. 

Cairo
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Enterprise Micro
Desktop Applications Module
Basesystem Module
openSUSE Leap
openEuler
libcairo-gobject2
libcairo-script-interpreter2-debuginfo
cairo-devel
libcairo-gobject2-debuginfo-32bit
libcairo-gobject2-debuginfo
libcairo2
libcairo2-32bit
libcairo2-debuginfo
libcairo-gobject2-32bit
libcairo2-debuginfo-32bit
cairo-debugsource
libcairo-script-interpreter2
cairo-tools
cairo-tools-debuginfo
libcairo2-64bit-debuginfo
cairo-devel-32bit
libcairo-gobject2-32bit-debuginfo
libcairo-script-interpreter2-32bit-debuginfo
libcairo2-32bit-debuginfo
libcairo-script-interpreter2-32bit
libcairo2-64bit
libcairo-script-interpreter2-64bit-debuginfo
libcairo-script-interpreter2-64bit
libcairo-gobject2-64bit
libcairo-gobject2-64bit-debuginfo
cairo-devel-64bit
cairo
cairo-debuginfo
cairo-gobject
cairo-gobject-devel

Install updates from vendor's website.

libcairo-gobject2 - addressed in versions 1.15.2-25.11.1, 1.16.0-150200.5.8.1, 1.16.0-150400.11.9.1, 1.18.4-150600.3.3.1
libcairo-script-interpreter2-debuginfo - addressed in versions 1.15.2-25.11.1, 1.16.0-150400.11.9.1, 1.18.4-150600.3.3.1
cairo-devel - addressed in versions 1.15.2-25.11.1, 1.16.0-150400.11.9.1, 1.18.4-150600.3.3.1
libcairo-gobject2-debuginfo-32bit - update to 1.15.2-25.11.1
libcairo-gobject2-debuginfo - addressed in versions 1.15.2-25.11.1, 1.16.0-150200.5.8.1, 1.16.0-150400.11.9.1, 1.18.4-150600.3.3.1
libcairo2 - addressed in versions 1.15.2-25.11.1, 1.16.0-150200.5.8.1, 1.16.0-150400.11.9.1, 1.18.4-150600.3.3.1
libcairo2-32bit - addressed in versions 1.15.2-25.11.1, 1.16.0-150400.11.9.1, 1.18.4-150600.3.3.1
libcairo2-debuginfo - addressed in versions 1.15.2-25.11.1, 1.16.0-150200.5.8.1, 1.16.0-150400.11.9.1, 1.18.4-150600.3.3.1
libcairo-gobject2-32bit - addressed in versions 1.15.2-25.11.1, 1.16.0-150400.11.9.1, 1.18.4-150600.3.3.1
libcairo2-debuginfo-32bit - update to 1.15.2-25.11.1
cairo-debugsource - addressed in versions 1.15.2-25.11.1, 1.16.0-150200.5.8.1, 1.16.0-150400.11.9.1, 1.18.4-150600.3.3.1
libcairo-script-interpreter2 - addressed in versions 1.15.2-25.11.1, 1.16.0-150400.11.9.1, 1.18.4-150600.3.3.1
cairo-tools - addressed in versions 1.16.0-150400.11.9.1, 1.18.4-150600.3.3.1
cairo-tools-debuginfo - addressed in versions 1.16.0-150400.11.9.1, 1.18.4-150600.3.3.1
libcairo2-64bit-debuginfo - addressed in versions 1.16.0-150400.11.9.1, 1.18.4-150600.3.3.1
cairo-devel-32bit - addressed in versions 1.16.0-150400.11.9.1, 1.18.4-150600.3.3.1
libcairo-gobject2-32bit-debuginfo - addressed in versions 1.16.0-150400.11.9.1, 1.18.4-150600.3.3.1
libcairo-script-interpreter2-32bit-debuginfo - addressed in versions 1.16.0-150400.11.9.1, 1.18.4-150600.3.3.1
libcairo2-32bit-debuginfo - addressed in versions 1.16.0-150400.11.9.1, 1.18.4-150600.3.3.1
libcairo-script-interpreter2-32bit - addressed in versions 1.16.0-150400.11.9.1, 1.18.4-150600.3.3.1
libcairo2-64bit - addressed in versions 1.16.0-150400.11.9.1, 1.18.4-150600.3.3.1
libcairo-script-interpreter2-64bit-debuginfo - addressed in versions 1.16.0-150400.11.9.1, 1.18.4-150600.3.3.1
libcairo-script-interpreter2-64bit - addressed in versions 1.16.0-150400.11.9.1, 1.18.4-150600.3.3.1
libcairo-gobject2-64bit - addressed in versions 1.16.0-150400.11.9.1, 1.18.4-150600.3.3.1
libcairo-gobject2-64bit-debuginfo - addressed in versions 1.16.0-150400.11.9.1, 1.18.4-150600.3.3.1
cairo-devel-64bit - addressed in versions 1.16.0-150400.11.9.1, 1.18.4-150600.3.3.1
cairo-tools - update to 1.18.0-2
cairo - update to 1.18.0-2
cairo-debuginfo - update to 1.18.0-2
cairo-debugsource - update to 1.18.0-2
cairo-devel - update to 1.18.0-2
cairo-gobject - update to 1.18.0-2
cairo-gobject-devel - update to 1.18.0-2

• https://github.com/Landw-hub/CVE-2025-50422
• https://gitlab.freedesktop.org/cairo/cairo/-/merge_requests/621
• https://gitlab.freedesktop.org/poppler/poppler/-/issues/1591
• https://gitlab.freedesktop.org/poppler/poppler/-/issues/1591#note_3045081

• Denial of service in Cairo
• SUSE update for cairo
• SUSE update for cairo
• SUSE update for cairo
• SUSE update for cairo
• openEuler 24.03 LTS update for cairo
• openEuler 24.03 LTS SP2 update for cairo
• openEuler 24.03 LTS SP1 update for cairo