CVE-2026-58496 Details
Description
Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.0.7, the `SFNT/TTF` font loader's `SfntLoader::gen` function in `tvgSfntLoader.cpp` reads `data[0] through data[3]` to identify the font type without first checking that the input buffer contains at least four bytes. Loading an undersized font directly from memory through public APIs such as `tvg::Text::load` causes an out-of-bounds read. Loading through a file path using `mmap` can mask the read because of page alignment; the memory-loading API directly exposes it. Depending on memory layout, a malformed short font may crash the consuming application or disclose adjacent heap memory. This issue is fixed in version 1.0.7.
A moderate out-of-bounds read vulnerability has been identified in Thor Vector Graphics (ThorVG) versions prior to 1.0.7. The issue arises in the SFNT/TTF font loader's 'SfntLoader::gen' function, located in 'tvgSfntLoader.cpp'. The vulnerability occurs because the function reads the first four bytes of the input buffer to determine the font type without verifying that the buffer contains at least four bytes. This oversight can lead to an out-of-bounds read when an undersized font is loaded directly from memory using public APIs such as 'tvg::Text::load'. While loading through a file path with 'mmap' can obscure the read due to page alignment, the memory-loading API exposes the vulnerability. Depending on the memory layout, a malformed short font could either crash the application or disclose adjacent heap memory.
Users can upgrade to ThorVG version 1.0.7, which addresses this vulnerability by adding proper data boundary checks in the font loader.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/thorvg/thorvg/security/advisories/GHSA-crfw-c34f-vqrj | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/thorvg/thorvg/commit/1dc232a33535946b5eed5fd65e993b13226da0ca | [email protected] | Source CodeVendor |
| https://github.com/thorvg/thorvg/releases/tag/v1.0.7 | [email protected] | Release NotesVendor |
| https://github.com/thorvg/thorvg/security/advisories/GHSA-crfw-c34f-vqrj | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Thor Vector Graphics | 1.0.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | [email protected] |