AIKIDO-2026-88019
agg is vulnerable to Uncontrolled Recursion
80
High Risk
This Affects:
aggTL;DR
Affected versions of Anti-Grain Geometry (agg) recurse without a bound in rasterizer_cells_aa::line when a segment's dx is at least dx_limit (16384 << poly_subpixel_shift). Integer overflow in the midpoint split can keep dx above that limit, so the function never returns and the stack is exhausted. Rendering a crafted path or SVG can crash the process. Version 2.5 and later stop the unbounded recursion.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you rasterize untrusted vector geometry or SVG with AGG.
Background info
agg is vulnerable to Uncontrolled Recursion in versions 0.0.1 - 2.6.
How to fix this
Upgrade the agg or aggeom-agg library to the patch version.
Links
Other
lists.debian.org/debian-lts-announce/2019/02/msg00001.htmllists.debian.org/debian-lts-announce/2021/12/msg00038.htmllists.debian.org/debian-lts-announce/2023/04/msg00001.html
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.