Ilya Sakhnenko

**Name of the Vulnerable Software and Affected Versions** cairo versions prior to 1.14.2 **Description** The issue allows remote attackers to cause a denial of service, resulting in an out-of-bounds read and application crash, via a negative span length. This is due to a buffer overflow in the fill xrgb32 lerp opaque spans function. **Recommendations** For versions prior to 1.14.2, update to version 1.14.2 or later to resolve the issue. As a temporary workaround, consider restricting the input to the fill xrgb32 lerp opaque spans function to prevent negative span lengths until a patch is applied.