---
id: "CVE-2026-123367"
page: "https://infrastack.ai/live/CVE-2026-123367"
kind: "vulnerability"
aliases: ["CVE-2026-123367"]
title: "ThorVG: crafted JPEG heap overflow in bundled decoder causes crash"
severity: "high"
cvss: 7.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["c++", "jpeg", "lottie", "package", "thorvg"]
not_affected_if: ["no-untrusted-images", "thorvg-1.1.2-or-later"]
published_at: "2026-11-09T18:17:25+00:00"
first_seen_at: "2026-11-09T18:27:55+00:00"
updated_at: "2026-11-09T18:29:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123367", "first_seen_at": "2026-11-09T18:27:55+00:00"}]
exploit_sources: []
---

# ThorVG: crafted JPEG heap overflow in bundled decoder causes crash

Link for people: https://infrastack.ai/live/CVE-2026-123367 (this .md is for agents)

ThorVG's bundled jpgd JPEG decoder does not check duplicate component selectors in a scan header, so a crafted grayscale JPEG writes past heap buffers. The confirmed impact is memory corruption that crashes the process, and the same path is reachable through JPEG images embedded in Lottie animations.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the ThorVG version your application bundles, for example with `grep -ri thorvg` in your dependency manifests or vendored sources.
- Look for the bundled file `src/loaders/jpg/tvgJpgd.cpp` in your build tree.
- Check whether your app decodes JPEGs or Lottie files from untrusted sources.

## Fix

- ThorVG: upgrade to `1.1.2` or later.

## Timeline

- 2026-11-09T18:27:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123367

## Documents

- [advisory] Vendor advisory: github.com https://github.com/thorvg/thorvg/security/advisories/GHSA-mw4c-w54x-248r
- [fix] Patch: github.com https://github.com/thorvg/thorvg/commit/67680c546d38d817e42eb7583dac8d87a4a319b5
- [fix] Patch: github.com https://github.com/thorvg/thorvg/commit/e740313029dd427d1ebd9f53f300da71363f80ce
- [fix] Release notes: github.com https://github.com/thorvg/thorvg/releases/tag/v1.1.2

## From the sources

Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.1.2, the bundled jpgd JPEG decoder accepts duplicate component selectors in an SOS scan header, causing each duplicate to increase m_blocks_per_mcu without checking the buffers sized from the frame components. A crafted grayscale JPEG can repeat its component in the SOS header, causing decode paths in src/loaders/jpg/tvgJpgd.cpp to write beyond heap buffers sized for one component. The issue is reachable through direct JPEG decoding and through JPEG images embedded in Lottie content, and confirmed impact is memory corruption followed by a process crash. This issue is fixed in version 1.1.2.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_