Posted by Khashayar Fereidani on Sep 26# usvg SVGZ decompression bomb in Tree::from_dataAuthor: Khashayar Fereidani
Disclosure Date: 2026-09-18
Advisory: https://fereidani.com/usvg-svgz-decompression-bomb-in-treefromdata
Contact: https://fereidani.com/contact ## Description Tree::from_data in crates/usvg/src/parser/mod.rs:102 detects the gzip magic
bytes at the start of the input and decompresses the data before parsing it: `rust
//...
Tree::from_dataAuthor: Khashayar Fereidani Disclosure Date: 2026-09-18 Advisory: https://fereidani.com/usvg-svgz-decompression-bomb-in-treefromdata Contact: https://fereidani.com/contact ## DescriptionTree::from_dataincrates/usvg/src/parser/mod.rs:102detects the gzip magic bytes at the start of the input and decompresses the data before parsing it:`rust //...