CVE-2014-5116

cairo 1.10.2 - Denial of Service via Large String in cairo_image_surface_get_data

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2014-5116. PoCs published by Osanda Malith Jayathissa.

AI-analyzed exploit summary This exploit triggers a read access violation in Wireshark by overflowing input fields with a large payload, causing a crash in the cairo_image_surface_get_data() function. The PoC generates a text file with 50,000 'A' characters to exploit the vulnerability.

Description

The cairo_image_surface_get_data function in Cairo 1.10.2, as used in GTK+ and Wireshark, allows context-dependent attackers to cause a denial of service (NULL pointer dereference) via a large string.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Osanda Malith Jayathissa · pythondoswindows
https://www.exploit-db.com/exploits/33384

This exploit triggers a read access violation in Wireshark by overflowing input fields with a large payload, causing a crash in the cairo_image_surface_get_data() function. The PoC generates a text file with 50,000 'A' characters to exploit the vulnerability.

Classification
Working Poc 90%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: Wireshark 1.10.7 (32-bit and 64-bit)
No auth needed
Prerequisites: Wireshark 1.10.7 installed on Windows · Access to vulnerable input fields (Filter text box, Statistics -> IP DESTINATIONS, or Statistics -> IP Addresses)
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Exploit exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/33384
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/107083

Scores

EPSS 0.0778
EPSS Percentile 93.9%

Details

Status published
Products (1)
cairographics/cairo 1.10.2
Published Jul 29, 2014
Tracked Since Feb 18, 2026