CVE-2026-58496

Received Received - Intake

Out-of-Bounds Read in Thor Vector Graphics Engine

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: GitHub, Inc.

Description

Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.0.7, the `SFNT/TTF` font loader's `SfntLoader::gen` function in `tvgSfntLoader.cpp` reads `data[0] through data[3]` to identify the font type without first checking that the input buffer contains at least four bytes. Loading an undersized font directly from memory through public APIs such as `tvg::Text::load` causes an out-of-bounds read. Loading through a file path using `mmap` can mask the read because of page alignment; the memory-loading API directly exposes it. Depending on memory layout, a malformed short font may crash the consuming application or disclose adjacent heap memory. This issue is fixed in version 1.0.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-27

Last Modified

2026-10-27

Generated

2026-10-28

AI Q&A

2026-10-28

EPSS Evaluated

N/A

NVD

CVE-2026-58496

Affected Vendors & Products

Vendor	Product	Version / Range
thorvg	thorvg	< 1.0.7

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is an out-of-bounds read in Thor Vector Graphics (ThorVG) versions prior to 1.0.7. The issue occurs in the SFNT/TTF font loader's SfntLoader::gen function, which reads the first four bytes of a font file without verifying the buffer has at least four bytes. Loading a malformed short font via memory APIs causes a crash or exposes adjacent heap memory.

Detection Guidance

This vulnerability can be detected by checking the Thor Vector Graphics (ThorVG) version installed on your system. If the version is below 1.0.7, the system is vulnerable. Use commands like 'thorvg --version' or check package managers (e.g., 'apt list --installed | grep thorvg') to verify the version.

Impact Analysis

This vulnerability can cause applications using ThorVG to crash when processing malformed font files. It may also lead to information disclosure if adjacent memory is exposed. Users could experience application instability or unintended data exposure depending on memory layout.

Compliance Impact

This vulnerability may lead to disclosure of adjacent heap memory, which could expose sensitive data depending on memory layout. This could potentially violate data protection requirements under GDPR or HIPAA if such data includes personal or health information.

Mitigation Strategies

Immediately update Thor Vector Graphics (ThorVG) to version 1.0.7 or later. If updating is not possible, avoid loading untrusted fonts directly from memory or file paths. Restrict access to public APIs like 'tvg::Text::load' to trusted sources only.

Hi! I’m here to help you understand CVE-2026-58496. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70