CVE-2026-45729: ThorVG: Null pointer dereference in SVG loader causes crash via 6-byte malformed input
Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to version 1.0.5, a null pointer dereference in SvgLoader::run() allows any caller that passes untrusted SVG data to Picture::load() to crash the process with a 6-byte payload. This issue has been patched in version 1.0.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ThorVGto a version that resolves this vulnerability.Fixed in 1.0.5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45729?
The severity of CVE-2026-45729 is medium with a score of 4.3.
What does CVE-2026-45729 impact?
CVE-2026-45729 impacts Samsung ThorVG, specifically the null pointer dereference in the SVG loader.
How do I fix CVE-2026-45729?
To fix CVE-2026-45729, update Samsung ThorVG to version 1.0.5 or later.
What type of vulnerability is CVE-2026-45729?
CVE-2026-45729 is classified as a null pointer dereference vulnerability.
What can happen if CVE-2026-45729 is exploited?
If CVE-2026-45729 is exploited, it can lead to a crash of the application when processing untrusted SVG data.