{"id":"CVE-2026-58496","kind":"vulnerability","aliases":["CVE-2026-58496"],"related":[],"title":"ThorVG: undersized font buffer causes out-of-bounds read on load","description":"Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.0.7, the `SFNT/TTF` font loader's `SfntLoader::gen` function in `tvgSfntLoader.cpp` reads `data[0] through data[3]` to identify the font type without first checking that the input buffer contains at least four bytes. Loading an undersized font directly from memory through public APIs such as `tvg::Text::load` causes an out-of-bounds read. Loading through a file path using `mmap` can mask the read because of page alignment; the memory-loading API directly exposes it. Depending on memory layout, a malformed short font may crash the consuming application or disclose adjacent heap memory. This issue is fixed in version 1.0.7.","summary":"ThorVG's SFNT/TTF font loader reads the first four bytes of a font buffer without checking its length, so a font under four bytes read from memory triggers an out-of-bounds read. An attacker supplying a malformed short font can crash the application or leak adjacent heap memory.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c++","package","thorvg","vector-graphics"],"not_affected_if":["file-path-font-loading","thorvg-1.0.7-or-later","trusted-fonts-only"],"how_to_check":"- Check the ThorVG version in use; affected if below `1.0.7`.\n- Search the codebase for calls to `tvg::Text::load` or other memory-based font loading that accept untrusted font data.","fix":"- Upgrade ThorVG to `1.0.7` or later.\n- Until upgraded, validate that font buffers are at least four bytes before passing them to memory-based font loading.","status":"open","published_at":"2026-10-27T23:17:06+00:00","first_seen_at":"2026-10-27T23:29:44+00:00","triaged_at":"2026-10-27T23:31:22+00:00","updated_at":"2026-10-27T23:31:22+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T23:31:22Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade ThorVG to `1.0.7` or later.\n- Until upgraded, validate that font buffers are at least four bytes before passing them to memory-based font loading.","reach":"unknown","title":"ThorVG: undersized font buffer causes out-of-bounds read on load","impact":"low","summary":"ThorVG's SFNT/TTF font loader reads the first four bytes of a font buffer without checking its length, so a font under four bytes read from memory triggers an out-of-bounds read. An attacker supplying a malformed short font can crash the application or leak adjacent heap memory.","category":"package","nicknames":[],"who_cares":["thorvg","c++","vector-graphics"],"confidence":0.7,"needs_auth":"no","worst_case":"Crash of the consuming application or disclosure of adjacent heap memory.","analyst_note":"","how_to_check":"- Check the ThorVG version in use; affected if below `1.0.7`.\n- Search the codebase for calls to `tvg::Text::load` or other memory-based font loading that accept untrusted font data.","needs_analyst":false,"not_affected_if":["file-path-font-loading","trusted-fonts-only","thorvg-1.0.7-or-later"],"who_is_affected":"Applications that embed ThorVG and load fonts from memory buffers, especially fonts from untrusted sources. Loading fonts only from file paths is less exposed because mmap page alignment can hide the read. Teams on ThorVG 1.0.7 or later, or who only load trusted bundled fonts, can skip it.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000636,"input_tokens":3466,"output_tokens":579,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-58496':15A,18A '0':102C '1.0.7':89C,192C '3':105C 'adjac':72B,183C 'align':159C 'api':132C,164C 'applic':69B,180C 'attack':60B 'bound':9A,57B,143C 'buffer':4A,38B,117C 'byte':34B,48B,122C 'c':19B 'caus':5A,138C 'check':40B,113C 'consum':179C 'contain':118C 'crash':67B,177C 'cve':13A,16A 'data':101C,104C 'depend':168C 'direct':127C,165C 'disclos':182C 'engin':86C 'expos':166C 'file':148C 'first':32B,112C 'fix':189C 'font':3A,28B,37B,45B,65B,92C,109C,126C,175C 'four':33B,47B,121C 'function':97C 'gen':96C 'graphic':24B,77C,85C 'heap':73B,184C 'identifi':107C 'input':116C 'issu':187C 'layout':171C 'leak':71B 'least':120C 'length':42B 'load':12A,123C,137C,145C,163C 'loader':29B,93C 'malform':63B,173C 'mask':153C 'may':176C 'memori':51B,74B,129C,162C,170C,185C 'memory-load':161C 'mmap':151C 'out-of-bound':6A,54B,140C 'packag':20B 'page':158C 'path':149C 'prior':87C 'product':82C 'production-readi':81C 'public':131C 'read':10A,30B,49B,58B,100C,144C,155C 'readi':83C 'sfnt/ttf':27B,91C 'sfntloader':95C 'short':64B,174C 'suppli':61B 'text':136C 'thor':75C 'thorvg':1A,21B,25B,78C 'trigger':52B 'tvg':135C 'tvgsfntloader.cpp':99C 'type':110C 'unders':2A,125C 'use':150C 'vector':23B,76C,84C 'vector-graph':22B 'version':191C 'without':39B,111C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed ThorVG and load fonts from memory buffers, especially fonts from untrusted sources. Loading fonts only from file paths is less exposed because mmap page alignment can hide the read. Teams on ThorVG 1.0.7 or later, or who only load trusted bundled fonts, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T23:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58496","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58496","severity":null,"published_at":"2026-10-27T23:17:06+00:00","modified_at":"2026-10-27T23:17:06+00:00","first_seen_at":"2026-10-27T23:29:44+00:00","fetched_at":"2026-10-27T23:29:44+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}