cairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free function incompatible with WebKit's fastMalloc, leading to an application crash with a "free(): invalid pointer" error.
Fix
Patch, vendor advisory and mitigation references on NVD 4
- https://bugs.webkit.org/show_bug.cgi?id=191595 Issue Tracking, Patch, Third Party Advisory
- https://gitlab.freedesktop.org/cairo/cairo/merge_requests/5 Patch, Third Party Advisory
- https://bugs.webkit.org/show_bug.cgi?id=191595 Issue Tracking, Patch, Third Party Advisory
- https://gitlab.freedesktop.org/cairo/cairo/merge_requests/5 Patch, Third Party Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.5 · cairographicsNVD modified 2026-10-15 18:17
Affected (CPE criteria) 1
cpe:2.3:a:cairographics:cairo:1.16.0:*:*:*:*:*:*:*
References 4
- https://bugs.webkit.org/show_bug.cgi?id=191595 Issue Tracking, Patch, Third Party Advisory
- https://gitlab.freedesktop.org/cairo/cairo/merge_requests/5 Patch, Third Party Advisory
- https://bugs.webkit.org/show_bug.cgi?id=191595 Issue Tracking, Patch, Third Party Advisory
- https://gitlab.freedesktop.org/cairo/cairo/merge_requests/5 Patch, Third Party Advisory