CVE-2026-123367 · Package
NO FIX YET · SEE WHAT TO DO
ThorVG's bundled jpgd JPEG decoder does not check duplicate component selectors in a scan header, so a crafted grayscale JPEG writes past heap buffers. The confirmed impact is memory corruption that crashes the process, and the same path is reachable through JPEG images embedded in Lottie animations.
first public Sep 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any application that bundles ThorVG before 1.1.2 and decodes JPEG images or Lottie animations, especially ones from untrusted sources. Applications that never load user-supplied JPEG or Lottie content are less exposed. The sources do not say which products embed ThorVG beyond this.
Not affected if no-untrusted-images, thorvg-1.1.2-or-later
Who cares c++, jpeg, lottie, thorvg
grep -ri thorvg in your dependency manifests or vendored sources.src/loaders/jpg/tvgJpgd.cpp in your build tree.1.1.2 or later.Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.1.2, the bundled jpgd JPEG decoder accepts duplicate component selectors in an SOS scan header, causing each duplicate to increase m_blocks_per_mcu without checking the buffers sized from the frame components. A crafted grayscale JPEG can repeat its component in the SOS header, causing decode paths in src/loaders/jpg/tvgJpgd.cpp to write beyond heap buffers sized for one component. The issue is reachable through direct JPEG decoding and through JPEG images embedded in Lottie content, and confirmed impact is memory corruption followed by a process crash. This issue is fixed in version 1.1.2.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.