Live › vulnerability › CVE-2026-58496
Go to dashboardThorVG's SFNT/TTF font loader reads the first four bytes of a font buffer without checking its length, so a font under four bytes read from memory triggers an out-of-bounds read. An attacker supplying a malformed short font can crash the application or leak adjacent heap memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 23:29 UTC. All times on this page are UTC.
Applications that embed ThorVG and load fonts from memory buffers, especially fonts from untrusted sources. Loading fonts only from file paths is less exposed because mmap page alignment can hide the read. Teams on ThorVG 1.0.7 or later, or who only load trusted bundled fonts, can skip it.
No product ranges from the sources yet.
1.0.7.tvg::Text::load or other memory-based font loading that accept untrusted font data.1.0.7 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.0.7, the SFNT/TTF font loader's SfntLoader::gen function in tvgSfntLoader.cpp reads data[0] through data[3] to identify the font type without first checking that the input buffer contains at least four bytes. Loading an undersized font directly from memory through public APIs such as tvg::Text::load causes an out-of-bounds read. Loading through a file path using mmap can mask the read because of page alignment; the memory-loading API directly exposes it. Depending on memory layout, a malformed short font may crash the consuming application or disclose adjacent heap memory. This issue is fixed in version 1.0.7.
This page as .md · .json · in your agent: get_signal("CVE-2026-58496")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.