CVE-2019-6462

An issue was discovered in cairo 1.16.0. There is an infinite loop in the function...

6.5 MediumFix available

An issue was discovered in cairo 1.16.0. There is an infinite loop in the function _arc_error_normalized in the file cairo-arc.c, related to _arc_max_angle_for_tolerance_normalized.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

2.14%Up 1.3 points since Apr 14, 2021

What each source reports

NVD Score used 6.5

An issue was discovered in cairo 1.16.0. There is an infinite loop in the function _arc_error_normalized in the file cairo-arc.c, related to _arc_max_angle_for_tolerance_normalized.

Record: CVE-2019-6462
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness: CWE-835
Updated: 2026-11-02

CVE List No score

An issue was discovered in cairo 1.16.0. There is an infinite loop in the function _arc_error_normalized in the file cairo-arc.c, related to _arc_max_angle_for_tolerance_normalized.

Record: CVE-2019-6462
Updated: 2026-11-02

EUVDEUVD-2019-16022 No score

An issue was discovered in cairo 1.16.0. There is an infinite loop in the function _arc_error_normalized in the file cairo-arc.c, related to _arc_max_angle_for_tolerance_normalized.

Record: EUVD-2019-16022
Updated: 2026-11-03

GitHub AdvisoriesGHSA-7m29-23h6-ccwp 6.5

An issue was discovered in cairo 1.16.0. There is an infinite loop in the function...

An issue was discovered in cairo 1.16.0. There is an infinite loop in the function _arc_error_normalized in the file cairo-arc.c, related to _arc_max_angle_for_tolerance_normalized.

Record: GHSA-7m29-23h6-ccwp
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-835
Updated: 2026-11-02

OSVALPINE-CVE-2019-6462 6.5

An issue was discovered in cairo 1.16.0. There is an infinite loop in the function _arc_error_normalized in the file cairo-arc.c, related to _arc_max_angle_for_tolerance_normalized.

Record: ALPINE-CVE-2019-6462
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVBELL-CVE-2019-6462 6.5

CVE-2019-6462 does not affect BellSoft software

Record: BELL-CVE-2019-6462
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 11 moreShow less

OSV 6.5

An issue was discovered in cairo 1.16.0. There is an infinite loop in the function _arc_error_normalized in the file cairo-arc.c, related to _arc_max_angle_for_tolerance_normalized.

Record: CVE-2019-6462
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2019-6462 6.5

An issue was discovered in cairo 1.16.0. There is an infinite loop in the function _arc_error_normalized in the file cairo-arc.c, related to _arc_max_angle_for_tolerance_normalized.

Record: DEBIAN-CVE-2019-6462
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVJLSEC-2025-16 6.5

An issue was discovered in cairo 1.16.0

An issue was discovered in cairo 1.16.0. There is an infinite loop in the function _arc_error_normalized in the file cairo-arc.c, related to _arc_max_angle_for_tolerance_normalized.

Record: JLSEC-2025-16
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Updated: 2026-11-02

OSVUBUNTU-CVE-2019-6462 6.5

An issue was discovered in cairo 1.16.0. There is an infinite loop in the function _arc_error_normalized in the file cairo-arc.c, related to _arc_max_angle_for_tolerance_normalized.

Record: UBUNTU-CVE-2019-6462
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVMGASA-2021-0497 No score

Updated cairo packages fix security vulnerability

An issue was discovered in cairo 1.16.0. There is an infinite loop in the function _arc_error_normalized in the file cairo-arc.c, related to _arc_max_angle_for_tolerance_normalized. (CVE-2019-6462)

Record: MGASA-2021-0497
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-12-CVE-2019-6462 No score

CVE-2019-6462 in cairo - Patched by Root

Root has patched CVE-2019-6462 in the cairo package for Root:Debian:12. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-12-CVE-2019-6462
Updated: 2026-11-02

OSVSUSE-SU-2021:3502-1 No score

Security update for cairo

This update for cairo fixes the following issues:

CVE-2019-6462: Fixed a potentially infinite loop (bsc#1122321).

Record: SUSE-SU-2021:3502-1
Updated: 2026-11-02

OSVSUSE-SU-2024:1704-1 No score

Security update for cairo

This update for cairo fixes the following issues:

CVE-2019-6462: Fixed a potentially infinite loop (bsc#1122321).

Record: SUSE-SU-2024:1704-1
Updated: 2026-11-02

OSVSUSE-SU-2024:1704-2 No score

Security update for cairo

This update for cairo fixes the following issues:

CVE-2019-6462: Fixed a potentially infinite loop (bsc#1122321).

Record: SUSE-SU-2024:1704-2
Updated: 2026-11-02

OSVSUSE-SU-2025:02795-1 No score

Security update for cairo

This update for cairo fixes the following issues:

CVE-2019-6462: Fixed a potentially infinite loop (bsc#1122321).

Record: SUSE-SU-2025:02795-1
Updated: 2026-11-02

OSVUSN-5407-1 No score

cairo vulnerabilities

Gustavo Grieco, Alberto Garcia, Francisco Oca, Suleman Ali, and others discovered that Cairo incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service. (CVE-2016-9082, CVE-2017-9814, CVE-2019-6462)

Stephan Bergmann discovered that Cairo incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service, or possibly execute arbitrary code. (CVE-2020-35492)

Record: USN-5407-1
Updated: 2026-11-02

Affected products

cairographics cairo

Affected packages

Affected packages
Package	Affected	Fixed
`cairo` Alpine:v3.12	before 1.16.0-r5	1.16.0-r5
`cairo` Alpine:v3.13	before 1.16.0-r4	1.16.0-r4
`cairo` Alpine:v3.14	before 1.16.0-r5	1.16.0-r5
`cairo` Alpine:v3.15	before 1.16.0-r5	1.16.0-r5
`cairo` Alpine:v3.16	before 1.17.4-r2	1.17.4-r2
`cairo` Alpine:v3.17	before 1.17.4-r1	1.17.4-r1
`cairo` Alpine:v3.18	before 1.17.4-r1	1.17.4-r1
`cairo` Alpine:v3.19	before 1.17.4-r1	1.17.4-r1
`cairo` Alpine:v3.20	before 1.17.4-r1	1.17.4-r1
`cairo` Alpine:v3.21	before 1.17.4-r1	1.17.4-r1

Show 27 moreShow less

Affected packages
Package	Affected	Fixed
`cairo` Alpine:v3.22	before 1.17.4-r1	1.17.4-r1
`cairo` Alpine:v3.23	before 1.17.4-r1	1.17.4-r1
`cairo` Alpine:v3.24	before 1.17.4-r1	1.17.4-r1
`cairo` Debian:12	All versions, plus listed versions 1.16.0-71.17.8-11.17.8-21.17.8-31.18.0-1 Show 8 moreShow less 1.18.0-1~hurd.11.18.0-21.18.0-31.18.2-11.18.2-21.18.4-11.18.4-21.18.4-3	None known
`cairo` Debian:13	before 1.17.8-3	1.17.8-3
`cairo` Debian:14	before 1.17.8-3	1.17.8-3
`Cairo_jll` Julia	1.16.0+0 up to 1.18.0+0	1.18.0+0
`cairo` Mageia:8	before 1.16.0-6.1.mga8	1.16.0-6.1.mga8
`cairo` Root:Debian:12	before 1.16.0-7.root.io.4	1.16.0-7.root.io.41.16.0-7.aikido.5
`rootio-cairo` Root:Debian:12	before 1.16.0-7.root.io.4	1.16.0-7.root.io.41.16.0-7.aikido.5
`cairo` SUSE:Linux Enterprise Software Development Kit 12 SP5	before 1.15.2-25.6.2	1.15.2-25.6.2
`cairo` SUSE:Linux Enterprise Server 12 SP5	before 1.15.2-25.6.2	1.15.2-25.6.2
`cairo` SUSE:Linux Enterprise Server for SAP Applications 12 SP5	before 1.15.2-25.6.2	1.15.2-25.6.2
`cairo` SUSE:Linux Enterprise Micro 5.3	before 1.16.0-150400.11.3.1	1.16.0-150400.11.3.1
`cairo` SUSE:Linux Enterprise Micro 5.4	before 1.16.0-150400.11.3.1	1.16.0-150400.11.3.1
`cairo` SUSE:Linux Enterprise Micro 5.5	before 1.16.0-150400.11.3.1	1.16.0-150400.11.3.1
`cairo` SUSE:Linux Enterprise Module for Basesystem 15 SP5	before 1.16.0-150400.11.3.1	1.16.0-150400.11.3.1
`cairo` SUSE:Linux Enterprise Module for Desktop Applications 15 SP5	before 1.16.0-150400.11.3.1	1.16.0-150400.11.3.1
`cairo` openSUSE:Leap Micro 5.3	before 1.16.0-150400.11.3.1	1.16.0-150400.11.3.1
`cairo` openSUSE:Leap Micro 5.4	before 1.16.0-150400.11.3.1	1.16.0-150400.11.3.1
`cairo` openSUSE:Leap 15.5	before 1.16.0-150400.11.3.1	1.16.0-150400.11.3.1
`cairo` SUSE:Linux Enterprise Micro 5.2	before 1.16.0-150200.5.5.1	1.16.0-150200.5.5.1
`cairo` Ubuntu:Pro:16.04:LTS	before 1.14.6-1ubuntu0.1~esm1, plus listed versions 1.14.2-2ubuntu21.14.4-11.14.6-1	1.14.6-1ubuntu0.1~esm1
`cairo` Ubuntu:Pro:18.04:LTS	before 1.15.10-2ubuntu0.1+esm1, plus listed versions 1.14.10-1ubuntu11.15.8-21.15.8-31.15.10-21.15.10-2ubuntu0.1	1.15.10-2ubuntu0.1+esm1
`cairo` Ubuntu:Pro:20.04:LTS	before 1.16.0-4ubuntu1+esm1, plus listed versions 1.16.0-41.16.0-4ubuntu1	1.16.0-4ubuntu1+esm1
`cairo` Ubuntu:22.04:LTS	before 1.16.0-5ubuntu2.1, plus listed versions 1.16.0-5ubuntu11.16.0-5ubuntu2	1.16.0-5ubuntu2.1
`cairo` Ubuntu:Pro:16.04:LTS From an advisory covering 4 CVEs	before 1.14.6-1ubuntu0.1~esm1, plus listed versions 1.14.2-2ubuntu21.14.4-11.14.6-1	1.14.6-1ubuntu0.1~esm1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-6462 is a medium vulnerability (CVSS 6.5) in Cairographics Cairo, published January 16, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.14%, the 82nd percentile. Fixed in cairo 1.16.0-r5.

References

Show 19 moreShow less