CVE-2026-123367

HIGH 7.4

ThorVG: Heap buffer overflow (OOB write) in bundled jpgd JPEG decoder

CVSS Score

7.4

EPSS Score

0.0%

EPSS Percentile

0th

Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.1.2, the bundled jpgd JPEG decoder accepts duplicate component selectors in an SOS scan header, causing each duplicate to increase m_blocks_per_mcu without checking the buffers sized from the frame components. A crafted grayscale JPEG can repeat its component in the SOS header, causing decode paths in src/loaders/jpg/tvgJpgd.cpp to write beyond heap buffers sized for one component. The issue is reachable through direct JPEG decoding and through JPEG images embedded in Lottie content, and confirmed impact is memory corruption followed by a process crash. This issue is fixed in version 1.1.2.

CWE	CWE-787
Vendor	thorvg
Product	thorvg
Published	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for thorvg thorvg

Be the first to know when new high vulnerabilities affecting thorvg thorvg are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

thorvg / thorvg

< 1.1.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/thorvg/thorvg/security/advisories/GHSA-mw4c-w54x-248r github.com: https://github.com/thorvg/thorvg/commit/67680c546d38d817e42eb7583dac8d87a4a319b5 github.com: https://github.com/thorvg/thorvg/commit/e740313029dd427d1ebd9f53f300da71363f80ce github.com: https://github.com/thorvg/thorvg/releases/tag/v1.1.2