CVE-2021-42702 Inkscape Access of Uninitialized Pointer

Low 3.3 Published 18 May 2022 Updated 16 Apr 2025

An attacker can exploit an uninitialized pointer in Inkscape to access unauthorized information, potentially leaking sensitive memory contents.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2021-42702?

CVE-2021-42702 is a low-severity vulnerability in Inkscape, published on 18 May 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Inkscape version 0.91 can access an uninitialized pointer, which may allow an attacker to have access to unauthorized information.

Weakness: CWE-824

Which versions are affected by CVE-2021-42702?

It affects 1 product.

Products include Inkscape Inkscape.

How do I fix CVE-2021-42702?

Upgrade to a fixed version.

Is CVE-2021-42702 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-42702 exists.

Sources

Also known as DEBIAN-CVE-2021-42702, GHSA-jg27-pgxp-gcv8, UBUNTU-CVE-2021-42702.