{"id":"CVE-2026-123367","kind":"vulnerability","aliases":["CVE-2026-123367"],"related":[],"title":"ThorVG: crafted JPEG heap overflow in bundled decoder causes crash","description":"Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.1.2, the bundled jpgd JPEG decoder accepts duplicate component selectors in an SOS scan header, causing each duplicate to increase m_blocks_per_mcu without checking the buffers sized from the frame components. A crafted grayscale JPEG can repeat its component in the SOS header, causing decode paths in src/loaders/jpg/tvgJpgd.cpp to write beyond heap buffers sized for one component. The issue is reachable through direct JPEG decoding and through JPEG images embedded in Lottie content, and confirmed impact is memory corruption followed by a process crash. This issue is fixed in version 1.1.2.","summary":"ThorVG's bundled jpgd JPEG decoder does not check duplicate component selectors in a scan header, so a crafted grayscale JPEG writes past heap buffers. The confirmed impact is memory corruption that crashes the process, and the same path is reachable through JPEG images embedded in Lottie animations.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c++","jpeg","lottie","package","thorvg"],"not_affected_if":["no-untrusted-images","thorvg-1.1.2-or-later"],"how_to_check":"- Check the ThorVG version your application bundles, for example with `grep -ri thorvg` in your dependency manifests or vendored sources.\n- Look for the bundled file `src/loaders/jpg/tvgJpgd.cpp` in your build tree.\n- Check whether your app decodes JPEGs or Lottie files from untrusted sources.","fix":"- ThorVG: upgrade to `1.1.2` or later.","status":"open","published_at":"2026-11-09T18:17:25+00:00","first_seen_at":"2026-11-09T18:27:55+00:00","triaged_at":"2026-11-09T18:29:17+00:00","updated_at":"2026-11-09T18:29:17+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T18:29:17Z","model":"claude-haiku-5-5","output":{"fix":"- ThorVG: upgrade to `1.1.2` or later.","reach":"unknown","title":"ThorVG: crafted JPEG heap overflow in bundled decoder causes crash","impact":"medium","summary":"ThorVG's bundled jpgd JPEG decoder does not check duplicate component selectors in a scan header, so a crafted grayscale JPEG writes past heap buffers. The confirmed impact is memory corruption that crashes the process, and the same path is reachable through JPEG images embedded in Lottie animations.","audience":"developers","category":"package","nicknames":[],"who_cares":["thorvg","lottie","jpeg","c++"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Heap memory corruption crashes the process; code execution not confirmed.","analyst_note":"Reach and whether the flaw can be turned into code execution are not stated in the sources; the bundled-component dependency list is not given.","how_to_check":"- Check the ThorVG version your application bundles, for example with `grep -ri thorvg` in your dependency manifests or vendored sources.\n- Look for the bundled file `src/loaders/jpg/tvgJpgd.cpp` in your build tree.\n- Check whether your app decodes JPEGs or Lottie files from untrusted sources.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-untrusted-images","thorvg-1.1.2-or-later"],"who_is_affected":"Any application that bundles ThorVG before 1.1.2 and decodes JPEG images or Lottie animations, especially ones from untrusted sources. Applications that never load user-supplied JPEG or Lottie content are less exposed. The sources do not say which products embed ThorVG beyond this.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000802,"input_tokens":4753,"output_tokens":654,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123367':13A,16A '-2026':12A,15A '1.1.2':84C,176C 'accept':90C 'anim':69B 'beyond':136C 'block':105C 'buffer':46B,111C,138C 'bundl':7A,24B,86C 'c':17B 'caus':9A,99C,129C 'check':30B,109C 'compon':32B,92C,116C,124C,142C 'confirm':48B,160C 'content':158C 'corrupt':52B,164C 'craft':2A,40B,118C 'crash':10A,54B,169C 'cve':11A,14A 'decod':8A,27B,89C,130C,150C 'direct':148C 'duplic':31B,91C,101C 'embed':66B,155C 'engin':81C 'fix':173C 'follow':165C 'frame':115C 'graphic':72C,80C 'grayscal':41B,119C 'header':37B,98C,128C 'heap':4A,45B,137C 'imag':65B,154C 'impact':49B,161C 'increas':103C 'issu':144C,171C 'jpeg':3A,18B,26B,42B,64B,88C,120C,149C,153C 'jpgd':25B,87C 'lotti':19B,68B,157C 'm':104C 'mcu':107C 'memori':51B,163C 'one':141C 'overflow':5A 'packag':20B 'past':44B 'path':60B,131C 'per':106C 'prior':82C 'process':56B,168C 'product':77C 'production-readi':76C 'reachabl':62B,146C 'readi':78C 'repeat':122C 'scan':36B,97C 'selector':33B,93C 'size':112C,139C 'sos':96C,127C 'src/loaders/jpg/tvgjpgd.cpp':133C 'thor':70C 'thorvg':1A,21B,22B,73C 'vector':71C,79C 'version':175C 'without':108C 'write':43B,135C","nicknames":[],"mitigations":[],"who_affected":"Any application that bundles ThorVG before 1.1.2 and decodes JPEG images or Lottie animations, especially ones from untrusted sources. Applications that never load user-supplied JPEG or Lottie content are less exposed. The sources do not say which products embed ThorVG beyond this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["c","high","jpeg","lottie","package","thorvg"],"campaign_type":null,"search_a":"'-123367':13A,16A '-2026':12A,15A 'bundl':7A 'caus':9A 'craft':2A 'crash':10A 'cve':11A,14A 'decod':8A 'heap':4A 'jpeg':3A 'overflow':5A 'thorvg':1A","search_b":"'anim':69B 'buffer':46B 'bundl':24B 'c':17B 'check':30B 'compon':32B 'confirm':48B 'corrupt':52B 'craft':40B 'crash':54B 'decod':27B 'duplic':31B 'embed':66B 'grayscal':41B 'header':37B 'heap':45B 'imag':65B 'impact':49B 'jpeg':18B,26B,42B,64B 'jpgd':25B 'lotti':19B,68B 'memori':51B 'packag':20B 'past':44B 'path':60B 'process':56B 'reachabl':62B 'scan':36B 'selector':33B 'thorvg':21B,22B 'write':43B","search_c":"'1.1.2':84C,176C 'accept':90C 'beyond':136C 'block':105C 'buffer':111C,138C 'bundl':86C 'caus':99C,129C 'check':109C 'compon':92C,116C,124C,142C 'confirm':160C 'content':158C 'corrupt':164C 'craft':118C 'crash':169C 'decod':89C,130C,150C 'direct':148C 'duplic':91C,101C 'embed':155C 'engin':81C 'fix':173C 'follow':165C 'frame':115C 'graphic':72C,80C 'grayscal':119C 'header':98C,128C 'heap':137C 'imag':154C 'impact':161C 'increas':103C 'issu':144C,171C 'jpeg':88C,120C,149C,153C 'jpgd':87C 'lotti':157C 'm':104C 'mcu':107C 'memori':163C 'one':141C 'path':131C 'per':106C 'prior':82C 'process':168C 'product':77C 'production-readi':76C 'reachabl':146C 'readi':78C 'repeat':122C 'scan':97C 'selector':93C 'size':112C,139C 'sos':96C,127C 'src/loaders/jpg/tvgjpgd.cpp':133C 'thor':70C 'thorvg':73C 'vector':71C,79C 'version':175C 'without':108C 'write':135C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-09T12:46:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123367","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123367","severity":null,"published_at":"2026-11-09T18:17:25+00:00","modified_at":"2026-11-09T18:17:25+00:00","first_seen_at":"2026-11-09T18:27:55+00:00","fetched_at":"2026-11-09T18:27:55+00:00","note":null}],"documents":[{"id":108787,"url":"https://github.com/thorvg/thorvg/commit/67680c546d38d817e42eb7583dac8d87a4a319b5","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":108788,"url":"https://github.com/thorvg/thorvg/commit/e740313029dd427d1ebd9f53f300da71363f80ce","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":108789,"url":"https://github.com/thorvg/thorvg/releases/tag/v1.1.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":108790,"url":"https://github.com/thorvg/thorvg/security/advisories/GHSA-mw4c-w54x-248r","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-09T12:46:54+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}