CVE-2026-58496: Medium severity ThorVG ThorVG vulnerability
Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.0.7, the SFNT/TTF font loader's SfntLoader::gen function in tvgSfntLoader.cpp reads data[0] through data[3] to identify the font type without first checking that the input buffer contains at least four bytes. Loading an undersized font directly from memory through public APIs such as tvg::Text::load causes an out-of-bounds read. Loading through a file path using mmap can mask the read because of page alignment; the memory-loading API directly exposes it. Depending on memory layout, a malformed short font may crash the consuming application or disclose adjacent heap memory. This issue is fixed in version 1.0.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ThorVGto a version that resolves this vulnerability.Fixed in 1.0.7
Event History
Frequently Asked Questions
Which applications are most exposed to this issue?
Applications using ThorVG before 1.0.7 that load SFNT/TTF font data directly from memory through public APIs such as tvg::Text::load are directly exposed. File-path loading may mask the issue when mmap page alignment makes adjacent bytes readable, but it should not be treated as safe.
What must an attacker provide to trigger the flaw?
An attacker needs to cause the application to load a malformed SFNT/TTF font buffer shorter than four bytes through the memory-loading API. The vulnerability requires user interaction according to the supplied CVSS vector.
What is the impact of a successful trigger?
Depending on the surrounding memory layout, the out-of-bounds read can crash the consuming application or disclose adjacent heap memory. The supplied severity information rates confidentiality impact as low and reports no integrity or availability impact.
What remediation is available?
Upgrade ThorVG to version 1.0.7, which fixes the issue. If upgrading cannot happen immediately, avoid passing untrusted or undersized font buffers to the direct memory-loading APIs and validate that font input contains at least four bytes before loading it.