CVE-2026-123367
Received Received - Intake

Heap Buffer Overflow in Thor Vector Graphics Engine

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: GitHub, Inc.

Description
Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.1.2, the bundled jpgd JPEG decoder accepts duplicate component selectors in an SOS scan header, causing each duplicate to increase m_blocks_per_mcu without checking the buffers sized from the frame components. A crafted grayscale JPEG can repeat its component in the SOS header, causing decode paths in src/loaders/jpg/tvgJpgd.cpp to write beyond heap buffers sized for one component. The issue is reachable through direct JPEG decoding and through JPEG images embedded in Lottie content, and confirmed impact is memory corruption followed by a process crash. This issue is fixed in version 1.1.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-123367
EUVD
EUVD-2026-120122

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
thorvg thor_vector_graphics 1.1.2
thorvg thorvg 1.1.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a heap buffer overflow in Thor Vector Graphics (ThorVG) versions before 1.1.2. It occurs when a crafted JPEG file contains duplicate component selectors in the SOS scan header. This causes the decoder to incorrectly calculate buffer sizes and write beyond allocated memory during JPEG decoding, leading to memory corruption and potential crashes.

Detection Guidance

To detect this vulnerability, inspect ThorVG versions in use. Check if any application using ThorVG is running versions 1.1.0, 1.1.1, or the main branch. Commands like 'ldd' or 'strings' on binaries may reveal linked ThorVG libraries. Network inspection tools cannot directly detect this flaw as it requires file content analysis.

Impact Analysis

The vulnerability can cause denial-of-service (DoS) crashes by corrupting memory during image processing. It may also allow code execution in some cases due to out-of-bounds writes. The issue affects systems processing untrusted JPEG images, including those embedded in Lottie files (.lottie or .dotLottie).

Mitigation Strategies

Upgrade ThorVG to version 1.1.2 or later immediately. Remove or disable any applications using vulnerable ThorVG versions. Avoid processing untrusted JPEG or Lottie files until patched. Monitor for crashes in image processing applications as potential exploitation indicators.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123367. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...