CVE-2025-50422

What it actually does

Assertion failure in _cairo_ft_unscaled_font_fini triggers a crash when unscaled->face is NULL during font finalization in Cairo <= 1.18.4 (used by Poppler <= 25.08.0).

Why it matters to the business

Local denial-of-service that can interrupt graphics processing or document rendering workloads on Alpine systems using the affected intel-ucode packages; low prevalence and no ransomware usage reduce urgency but still require patching older deployments.

How an attack unfolds

An attacker with local access supplies a specially crafted font or document that reaches the unscaled font cleanup path in Cairo, causing the assertion to fire and the process to terminate.

How to fix it

Upgrade intel-ucode on Alpine v3.19 and v3.20 to version 20250812-r0 or later; rebuild or redeploy any packages that statically link the fixed Cairo library.

How to confirm the fix worked

Confirm package version is at or above 20250812-r0 via apk info; test rendering of documents containing complex fonts to ensure no assertion crash occurs.

Typical attack path

1. Obtain local execution or file write access on target system
2. Place or reference a malicious font file that triggers the unscaled font path
3. Invoke an application linked against the vulnerable Cairo/Poppler library (e.g., PDF viewer or renderer)
4. Trigger font finalization to hit the NULL face assertion and crash the process

How to detect it

Review system logs for Cairo assertion failures mentioning _cairo_ft_unscaled_font_fini or face == NULL; correlate with process crashes in PDF or graphics tools on Alpine hosts.

What your security team should do

• Apply the 20250812-r0 intel-ucode update on all Alpine v3.19/v3.20 instances within the next maintenance window
• Inventory applications that depend on Cairo or Poppler and schedule library rebuilds
• Monitor EPSS trend (currently low but rising 11 %) and re-evaluate if exploit code appears