CVE-2026-45729
4.3 MEDIUMThor Vector Graphics (ThorVG) is a production-ready vector graphics engine
Published: 2026-06-01 · Last updated: 2026-06-02
Severity and scoring
- CVSS
- 4.3 MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
- CWE
- CWE-476
Description
Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to version 1.0.5, a null pointer dereference in SvgLoader::run() allows any caller that passes untrusted SVG data to Picture::load() to crash the process with a 6-byte payload. This issue has been patched in version 1.0.5.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-45729
- [Other]https://github.com/thorvg/thorvg/commit/159f44fd5e3d2eea1b3a70689a894e657e2bb079
- [Other]https://github.com/thorvg/thorvg/pull/4387
- [Other]https://github.com/thorvg/thorvg/releases/tag/v1.0.5
- [Other]https://github.com/thorvg/thorvg/security/advisories/GHSA-f863-8ghq-7h64
- [Other]https://github.com/thorvg/thorvg/security/advisories/GHSA-f863-8ghq-7h64
Related CVEs
Same CWE
- CVE-2025-7018 — Null pointer dereference vulnerability in Avira Antivirus engine when scanning a malformed Windows PE file may allow Denial-of-Service of... (5.5 MEDIUM)
- CVE-2026-53463 — ImageMagick is free and open-source software used for editing and manipulating digital images (4.3 MEDIUM)
- CVE-2026-24716 — A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions
- CVE-2026-22899 — A NULL pointer dereference vulnerability has been reported to affect File Station 6 (6.5 MEDIUM)
- CVE-2025-66281 — A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions