CVE-2026-58496

MediumCVSS 4.3

Published: 27/10/2026(UTC)Updated: 02/11/2026(UTC)Translated: 28/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

In Thor Vector Graphics (ThorVG) prior to 1.0.7, the SfntLoader::gen function in tvgSfntLoader.cpp reads data without first checking that the buffer contains at least four bytes, causing an out-of-bounds read. Loading an undersized font via memory APIs may crash the application or disclose adjacent heap memory.

Risk Assessment

A malicious or malformed font could crash the application or leak memory data. The risk affects applications loading fonts from untrusted sources.

Recommendation

Update ThorVG to version 1.0.7 or later. Avoid loading untrusted fonts through memory APIs until patched.

Other vulnerabilities in ThorVG

CVE-2026-45729Medium
Thor Vector Graphics (ThorVG) before version 1.0.5 has a null pointer dereference vulnerability in SvgLoader::run(). Any caller passing untrusted SVG data to Picture::load() can crash the process with a 6-byte payload.

Original NVD description (English source)

Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.0.7, the `SFNT/TTF` font loader's `SfntLoader::gen` function in `tvgSfntLoader.cpp` reads `data[0] through data[3]` to identify the font type without first checking that the input buffer contains at least four bytes. Loading an undersized font directly from memory through public APIs such as `tvg::Text::load` causes an out-of-bounds read. Loading through a file path using `mmap` can mask the read because of page alignment; the memory-loading API directly exposes it. Depending on memory layout, a malformed short font may crash the consuming application or disclose adjacent heap memory. This issue is fixed in version 1.0.7.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS