thorvg vulnerabilities

CVEs whose affected-version data names the thorvg package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-58496Medium· 4.3

6d ago

ThorVG: Out-of-bounds Read in SFNT/TTF Font Loader via Memory API

Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.0.7, the `SFNT/TTF` font loader's `SfntLoader::gen` function in `tvgSfntLoader.cpp` reads `data[0] through data[3]` to identify the font type without …

▾ Sunlitthorvg · thorvgvia CVEORG