CVE-2026-45729

Published: Giu 01, 2026 Last Modified: Giu 01, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 4,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: low

Description

AI Translation Available

Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to version 1.0.5, a null pointer dereference in SvgLoader::run() allows any caller that passes untrusted SVG data to Picture::load() to crash the process with a 6-byte payload. This issue has been patched in version 1.0.5.

476

NULL Pointer Dereference

Stable
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Availability Integrity Confidentiality
Potential Impacts:
Dos: Crash, Exit, Or Restart Execute Unauthorized Code Or Commands Read Memory Modify Memory
Applicable Platforms
Languages: C, C++, Java, C#, Go
Likelihood of Exploit: Medium
View CWE Details
https://github.com/thorvg/thorvg/commit/159f44fd5e3d2eea1b3…
https://github.com/thorvg/thorvg/commit/159f44fd5e3d2eea1b3a70689a894e657e2bb079
https://github.com/thorvg/thorvg/pull/4387
https://github.com/thorvg/thorvg/pull/4387
https://github.com/thorvg/thorvg/releases/tag/v1.0.5
https://github.com/thorvg/thorvg/releases/tag/v1.0.5
https://github.com/thorvg/thorvg/security/advisories/GHSA-f…
https://github.com/thorvg/thorvg/security/advisories/GHSA-f863-8ghq-7h64