Source: thorvg Version: 1.0.6+dfsg-1 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerability was published for thorvg. CVE-2026-58496[0]: | Thor Vector Graphics (ThorVG) is a production-ready vector graphics | engine. Prior to 1.0.7, the `SFNT/TTF` font loader's | `SfntLoader::gen` function in `tvgSfntLoader.cpp` reads `data[0] | through data[3]` to identify the font type without first checking | that the input buffer contains at least four bytes. Loading an | undersized font directly from memory through public APIs such as | `tvg::Text::load` causes an out-of-bounds read. Loading through a | file path using `mmap` can mask the read because of page alignment; | the memory-loading API directly exposes it. Depending on memory | layout, a malformed short font may crash the consuming application | or disclose adjacent heap memory. This issue is fixed in version | 1.0.7. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-58496 https://www.cve.org/CVERecord?id=CVE-2026-58496 [1] https://github.com/thorvg/thorvg/security/advisories/GHSA-crfw-c34f-vqrj [2] https://github.com/thorvg/thorvg/commit/1dc232a33535946b5eed5fd65e993b13226da0ca (v1.0.7) Please adjust the affected versions in the BTS as needed. Regards, Salvatore
