CVE-2025-10728

Executive Summary

CVE-2025-10728 describes a denial-of-service (DoS) vulnerability in an unknown SVG rendering module that fails to properly handle recursive <pattern> elements. When the module processes a crafted SVG file containing nested <pattern> references, it enters an uncontrolled recursion loop, ultimately exhausting the call stack and crashing the application. The vulnerability has a low EPSS score (0.00203) indicating limited active exploitation, and no CISA KEV inclusion. While the precise vendor and product remain unidentified, the flaw is classified under CWE-674 (Uncontrolled Recursion). A patch is claimed by a single source (Debian) but not independently confirmed, leaving a gap in verification. Enterprise environments that render untrusted SVG files — including web browsers, document processors, and image preview services — are potentially at risk.

Technical Analysis

The vulnerability resides in how the affected module parses and renders SVG (Scalable Vector Graphics) files. SVG is an XML-based vector image format that supports structural elements, including <defs> (definitions) and <pattern> (tiling definitions). A <pattern> element defines a reusable tile that can fill a shape. Critically, SVG allows a <pattern> to reference itself either directly or indirectly — e.g., a <pattern> whose content includes another <pattern> that eventually loops back to the original.

The flaw triggers when the rendering engine walks the SVG DOM tree to rasterize <pattern> elements. Under normal operation, the renderer iterates over each element once. However, when a pattern references itself — directly or through a cycle — the renderer fails to maintain a "visited set" or depth counter. Instead, it recursively descends into the pattern definition repeatedly. Each recursive call consumes stack space (typically 1–8 KB per call depending on architecture and XML parser overhead). A malicious SVG with a pattern depth of just a few thousand nested references will exhaust the thread's stack, causing an unhandled exception, segmentation fault, or forced process termination.

The attack vector is straightforward: a specially crafted SVG file, often no larger than a few kilobytes, containing XML like:

<svg xmlns="http://www.w3.org/2000/svg">
  <defs>
    <pattern id="a" patternUnits="userSpaceOnUse" width="10" height="10">
      <pattern id="b" patternUnits="userSpaceOnUse" width="10" height="10">
        <pattern id="c" patternUnits="userSpaceOnUse" width="10" height="10">
          <!-- recursive reference back to 'a' -->
          <use href="#a"/>
        </pattern>
      </pattern>
    </pattern>
  </defs>
  <rect fill="url(#a)" width="100" height="100"/>
</svg>

The renderer, upon resolving fill="url(#a)", enters pattern a, then b, then c, then back to a — infinite recursion. The lack of cycle detection or recursion depth limits is the core weakness (CWE-674).

The attack surface includes anywhere untrusted SVG files are rendered: web browsers (if the SVG is embedded in HTML or loaded directly), email clients with SVG preview, document conversion tools (e.g., Office suites, PDF generators), image thumbnail services, and chat applications. The CNA and vendor attribution remain unknown; however, the Debian patch claim suggests the module is likely an open-source component distributed in Debian repositories. The most probable candidates are libraries like librsvg, QtSvg, resvg, or a similar SVG rasterizer.

Exploitation Scenarios

Despite no known public PoC, an attacker can weaponize this vulnerability through the following concrete chain:

1) Reconnaissance: The attacker targets an internet-facing service that accepts image uploads — e.g., a web application profile picture upload, a SaaS file converter, a document management system, or a social media platform. They first identify the backend SVG renderer by uploading benign test SVGs and observing response headers, error messages, or timing differences. For local exploitation, the attacker crafts a malicious .svg file and entices a victim to open it via email, messaging, or web download.

2) Weaponization: The attacker constructs the malicious SVG file. Using a text editor or script, they generate a nested <pattern> structure with ~10,000–50,000 recursive references (filesize remains under 50 KB). They embed the file in an email attachment, a link, or upload it to the target service. To maximize impact on shared infrastructure, the attacker may obfuscate the XML using entity expansion or whitespace compression to evade simple static filters that look for <pattern> elements.

3) Trigger/Execution: The attacker causes the SVG to be rendered. In a hosted service, this happens automatically upon upload (thumbnail generation). In a browser, the victim clicks the link, opening the SVG. In an email client, the preview pane triggers rendering. The rendering engine begins processing the root <svg> element, encounters the <rect> with url(#pattern), and starts resolving the pattern chain. Recursion proceeds unchecked; stack depth grows linearly with pattern nesting.

4) Post-exploitation Impact: The rendering thread crashes with a stack overflow. In a multi-threaded web server, the worker thread dies, potentially forcing a restart of the entire process if the crash is in a shared library and unwinds badly. For an application that processes uploads synchronously, the entire service becomes unavailable. If the renderer runs as a privileged subsystem (e.g., a document preview daemon), the crash may cascade to dependent processes. Repeated uploads of the same file create a low-cost DoS loop: the attacker sends thousands of requests, each crashing a worker thread, severely degrading or completely halting the service. Additionally, if the crash occurs in a memory-safe language runtime (e.g., Rust-based resvg), it may be an abort rather than a graceful error, leaving the application in an inconsistent state.

Impact Assessment

The vulnerability's CVSS score is N/A due to missing vendor scoring; however, applying the qualitative guidance for CWE-674, the likely exploitability is high (AV:N/AC:L/PR:N/UI:R) in hosted contexts where users upload files, and the availability impact is High. The attacker needs no privileges, requires no user interaction if the service automatically renders uploads, and the attack complexity is low. The core impact is denial-of-service: the vulnerable process crashes, and availability is compromised.

Business blast radius includes:

• SaaS platforms offering image conversion or editing — an attacker degrades service for all tenants.
• Enterprise document systems — a malicious SVG embedded in a PDF or Word document crashes the rendering engine during preview.
• Email gateways that sanitize or preview attachments — a crafted SVG halts the scanning pipeline.
• OT/ICS HMIs that display SVG-based process diagrams — a malicious file uploaded to a historian could crash the display service, hindering operator visibility.

The EPSS score of 0.00203 places this among the lowest 10.5% of exploited CVEs, meaning mass exploitation is unlikely; targeted attacks — e.g., against a specific SaaS competitor or critical infrastructure — are the primary threat. The unknown vendor attribution hampers patch deployment; organizations may run the vulnerable module without awareness, as it could be an embedded dependency of a larger product.

Detection Guidance

Sigma Rule

title: Potential CVE-2025-10728 SVG Pattern Recursion DoS Attempt
id: 9f8a3c1e-6b4d-4a2e-8f1b-1c3d5e7a9b0c
status: experimental
description: Detects upload or access of SVG files containing recursive pattern elements potentially triggering stack overflow DoS.
author: Valtersi Threat Intel
date: 2025/04/15
logsource:
  category: webserver
  product: generic
  service: http
detection:
  selection_method:
    http.method: ['GET', 'POST', 'PUT']
  selection_content_type:
    http.content_type|contains: 'image/svg+xml'
  selection_recursive_patterns:
    http.body|contains|all:
      - '<pattern'
      - '<use'
    http.body|re: '(?:<pattern[^>]*>.*?){10,}.*<use[^>]*href='
  condition: selection_method and selection_content_type and selection_recursive_patterns
falsepositives:
  - Legitimate complex SVG graphics with many patterns (rare)
  - Auto-generated files from vector design tools
level: medium

YARA Rule

rule CVE_2025_10728_SVG_Pattern_Recursion
{
    meta:
        author = "Valtersi Threat Intel"
        description = "Detects SVG files with deep nested pattern recursion indicating CVE-2025-10728 DoS attempt"
        cve = "CVE-2025-10728"
        date = "2025-04-15"
    strings:
        $svg_open = /<svg[\s>]/i
        $pattern = /<pattern[\s>]/i
        $use = /<use[^>]*href=/i
        $ndef1 = "http://www.w3.org/2000/svg"
    condition:
        uint32(0) == 0x3C535647 or $svg_open and #pattern >= 8 and $use and $ndef1
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2025-10728 SVG recursive pattern DoS attempt"; flow:to_server,established; content:"image/svg+xml"; http.content_type; content:"<pattern"; http.request_body; content:"<use"; http.request_body; pcre:"/<pattern[^>]*>.*?<pattern[^>]*>.*?<pattern[^>]*>/i"; http.request_body; classtype:attempted-dos; sid:2025107281; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [ network where dns.question.name : "*" and process.name : "*" ]
  [ file where event.type == "create" and
      file.extension == "svg" and
      file.size > 1024 and
      file.size < 102400 ]
  [ process where event.type == "start" and
      process.name : ("*rsvg*", "*svg*", "*render*", "*convert*") and
      process.args : "*.svg" ]

Splunk SPL Query

index=web OR index=proxy
| search "image/svg+xml" OR "*.svg"
| rex field=_raw "(?<pattern_count>(?i)<pattern)" max_match=100
| where pattern_count >= 20
| rex field=_raw "(?<use_count>(?i)<use[^>]*href=)" max_match=100
| where use_count >= 1
| table _time, src_ip, dest_host, uri, http_method, user_agent, pattern_count, use_count
| sort - pattern_count

Wazuh OSSEC Rule

<group name="cve-2025-10728,">
  <rule id="393834" level="10">
    <decoded_as>json</decoded_as>
    <field name="content_type">image/svg+xml</field>
    <description>CVE-2025-10728: SVG file with recursive pattern elements detected</description>
    <regex>field\.name\s*=\s*"pattern"</regex>
    <mitre>
      <id>T1499.001</id>
    </mitre>
    <group>dos,svg,upload</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 2/4 (CLAIMED) — a single source (Debian) claims a patch, but it is not independently confirmed. This warrants caution: verify the patch before deployment, and assume the vulnerability may still be exploitable until proven otherwise.

1) Immediate mitigation:

• If the vulnerable module is a known dependency (e.g., librsvg, QtSvg), restrict SVG rendering to trusted sources only.
• Deploy a web application firewall (WAF) rule that inspects uploaded files for the pattern described in the Sigma rule above and blocks content with >10 nested <pattern> elements.
• For services that render user-uploaded images, disable SVG processing or render SVGs in an isolated, resource-constrained sandbox (e.g., separate microservice with a strict memory/CPU limit and automatic restart-on-crash policy).
• For email servers: strip or quarantine SVG attachments via MTA filtering until a verified patch is applied.

2) Patch/upgrade:

• Monitor the Debian security tracker (security-tracker.debian.org) for the advisory referencing CVE-2025-10728.
• Once the specific package is identified, apply the patched version. If Debian has published a fix, it will be in the bookworm-security or bullseye-security suite; use apt-get update && apt-get upgrade for the relevant package.
• Independently verify the patch by reproducing the vulnerability in a test environment before production deployment.
• If the module is embedded in a commercial product, contact the vendor for guidance and request confirmation of the fix.

3) Long-term hardening:

• Inventory all software that processes SVG files across the enterprise; create a software bill of materials (SBOM) to track this dependency.
• Enable automated vulnerability scanning for the identified library in CI/CD pipelines.
• Consider replacing the vulnerable renderer with a memory-safe alternative (e.g., resvg with sandboxing) if the patch remains unverified for an extended period.
• Implement application-level recursion depth limits for XML processing (e.g., via XML parser configuration) as a defense-in-depth measure.
• Subscribe to the CVE record for updates and re-assess exposure when the vendor is clarified.

References

1. NVD Entry — CVE-2025-10728: https://nvd.nist.gov/vuln/detail/CVE-2025-10728
2. Debian Security Tracker (patch claim source): https://security-tracker.debian.org/tracker/CVE-2025-10728
3. CWE-674 — Uncontrolled Recursion: https://cwe.mitre.org/data/definitions/674.html
4. FIRST EPSS — CVE-2025-10728: https://www.first.org/epss/search?cve=CVE-2025-10728
5. CISA Known Exploited Vulnerabilities Catalog (confirms not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Known threat actor campaigns: No active campaigns, exploit-in-the-wild evidence, or public proofs-of-concept were identified as of this report. However, the vulnerability class (stack overflow via recursive pattern rendering) has been exploited historically in similar libraries — e.g., past librsvg issues and ImageMagick SVG handler crashes — suggesting the technique is well-known to red teams and malicious actors. The low EPSS score suggests that if exploitation is occurring, it is either highly targeted or very recent.