CVE-2026-58496

The record

Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.0.7, the `SFNT/TTF` font loader's `SfntLoader::gen` function in `tvgSfntLoader.cpp` reads `data[0] through data[3]` to identify the font type without first checking that the input buffer contains at least four bytes. Loading an undersized font directly from memory through public APIs such as `tvg::Text::load` causes an out-of-bounds read. Loading through a file path using `mmap` can mask the read because of page alignment; the memory-loading API directly exposes it. Depending on memory layout, a malformed short font may crash the consuming application or disclose adjacent heap memory. This issue is fixed in version 1.0.7.

Affected packages

Related vulnerabilities

• CVE-2026-62958 libriscv is a RISC-V sandbox and emulator. CWE-125
• CVE-2026-119338 Tesseract is an open source OCR engine. CWE-125
• CVE-2026-119299 gopacket provides packet processing capabilities for Go. CWE-125
• CVE-2026-119722 Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access… CWE-125
• CVE-2026-119721 Blender before 4.5.15 and 5.x before 5.2.3 contains an out-of-bounds read vulnerability… CWE-125
• CVE-2026-119720 Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds read… CWE-125
• CVE-2026-104063 Scribus before 1.6.7 contains an out-of-bounds read vulnerability in the Mac PICT image… CWE-125
• CVE-2026-61627 libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation… CWE-125