Read the docs
TI-2021-18915 Aliases CVE-2021-42702GHSA-jg27-pgxp-gcv8

Inkscape Access of Uninitialized Pointer

Priority MEDIUM 49CWE-824Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Will not fix Red Hat: no fix planned

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

Inkscape version 0.91 can access an uninitialized pointer, which may allow an attacker to have access to unauthorized information.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00974 62nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Will not fix Red Hat: no fix planned

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
InkscapeInkscape0.91—No fix listedCNA
  • Inkscape VendorInkscape Affected 0.91 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:inkscape:inkscape:0.91:*:*:*:*:*:*:*0.91VulnerableInkscape
  • cpe:2.3:a:inkscape:inkscape:0.91:*:*:*:*:*:*:* Versions 0.91 Vulnerable ·Inkscape

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Not affected: 2 products
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-42702
  2. 2026-10-03 Alias added: GHSA-jg27-pgxp-gcv8

References

Exploit 1

Advisory 1

  • TI-2021-18917 Inkscape Out-of-bounds Write CVSS 3.1HIGH 7.8
  • TI-2026-04341 Improper Restriction of XML External Entity Reference in Inkscape CVSS 3.1MEDIUM 6.3
  • TI-2021-18913 Inkscape Out-of-bounds Read CVSS 3.1LOW 3.3
  • TI-2005-03531 Buffer overflow in the SVG importer (style.cpp) of inkscape 0.41 through 0.42.2 might… CVSS 2.0MEDIUM 5.1
  • TI-2007-01406 Format string vulnerability in the whiteboard Jabber protocol in Inkscape before 0.45.1… CVSS 2.0MEDIUM 6.8
  • TI-2007-01405 Format string vulnerability in Inkscape before 0.45.1 allows user-assisted remote… CVSS 2.0MEDIUM 6.8
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences