CVE-2024-33768

The vulnerability is triggered by the composition_solid_source_over component responsible for graphics composition operations when rendering SVG files. Improper input data processing causes a segmentation fault, which means access to an unauthorized memory area. The error can potentially be triggered by providing a specially crafted SVG file, which corresponds to the CWE-653 class (insufficient isolation or compartmentalization of sensitive components).

An attacker can cause unauthorized read and write access to process memory, potentially enabling remote code execution (RCE), privilege escalation, or application crash. A high CVSS score (9.8) indicates the possibility of violating system confidentiality, integrity, and availability without any authorization.

Patches available from the vendor should be applied according to references. It is recommended to monitor the LunaSVG project repository for the release of a patched version and to avoid processing untrusted SVG files using the vulnerable version of the library.

Sammycage LunaSVG version 2.3.9