CVE-2026-123367

Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine.

Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.1.2, the bundled jpgd JPEG decoder accepts duplicate component selectors in an SOS scan header, causing each duplicate to increase m_blocks_per_mcu without checking the buffers sized from the frame components. A crafted grayscale JPEG can repeat its component in the SOS header, causing decode paths in src/loaders/jpg/tvgJpgd.cpp to write beyond heap buffers sized for one component. The…

9. Nov 2026

Ausgewertete Quellen

• NVD
  CVE-2026-123367