CVE-2026-58496

Full vulnerability record from the local CVENow database.

Description

Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.0.7, the `SFNT/TTF` font loader's `SfntLoader::gen` function in `tvgSfntLoader.cpp` reads `data[0] through data[3]` to identify the font type without first checking that the input buffer contains at least four bytes. Loading an undersized font directly from memory through public APIs such as `tvg::Text::load` causes an out-of-bounds read. Loading through a file path using `mmap` can mask the read because of page alignment; the memory-loading API directly exposes it. Depending on memory layout, a malformed short font may crash the consuming application or disclose adjacent heap memory. This issue is fixed in version 1.0.7.

Severity

MEDIUM

CVSS score

4.3 (v3.1)

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2026-10-27 23:17:06.420000

Last modified

2026-11-02 20:17:46.827000

View original CVE JSON

{
  "id": "CVE-2026-58496",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-27T23:17:06.420",
  "lastModified": "2026-11-02T20:17:46.827",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.0.7, the `SFNT/TTF` font loader's `SfntLoader::gen` function in `tvgSfntLoader.cpp` reads `data[0] through data[3]` to identify the font type without first checking that the input buffer contains at least four bytes. Loading an undersized font directly from memory through public APIs such as `tvg::Text::load` causes an out-of-bounds read. Loading through a file path using `mmap` can mask the read because of page alignment; the memory-loading API directly exposes it. Depending on memory layout, a malformed short font may crash the consuming application or disclose adjacent heap memory. This issue is fixed in version 1.0.7."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "thorvg",
          "product": "thorvg",
          "versions": [
            {
              "version": "< 1.0.7",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-11-02T19:46:00.737335Z",
          "id": "CVE-2026-58496",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/thorvg/thorvg/commit/1dc232a33535946b5eed5fd65e993b13226da0ca",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/thorvg/thorvg/releases/tag/v1.0.7",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/thorvg/thorvg/security/advisories/GHSA-crfw-c34f-vqrj",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/thorvg/thorvg/security/advisories/GHSA-crfw-c34f-vqrj",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}