CVE-2026-58496

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-58496", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-30T20:21:25.813Z", "datePublished": "2026-10-27T22:18:34.301Z", "dateUpdated": "2026-11-02T19:46:26.453Z"}, "containers": {"cna": {"title": "ThorVG: Out-of-bounds Read in SFNT/TTF Font Loader via Memory API", "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/thorvg/thorvg/security/advisories/GHSA-crfw-c34f-vqrj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/thorvg/thorvg/security/advisories/GHSA-crfw-c34f-vqrj"}, {"name": "https://github.com/thorvg/thorvg/commit/1dc232a33535946b5eed5fd65e993b13226da0ca", "tags": ["x_refsource_MISC"], "url": "https://github.com/thorvg/thorvg/commit/1dc232a33535946b5eed5fd65e993b13226da0ca"}, {"name": "https://github.com/thorvg/thorvg/releases/tag/v1.0.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/thorvg/thorvg/releases/tag/v1.0.7"}], "affected": [{"vendor": "thorvg", "product": "thorvg", "versions": [{"version": "< 1.0.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-27T22:18:34.301Z"}, "descriptions": [{"lang": "en", "value": "Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.0.7, the `SFNT/TTF` font loader's `SfntLoader::gen` function in `tvgSfntLoader.cpp` reads `data[0] through data[3]` to identify the font type without first checking that the input buffer contains at least four bytes. Loading an undersized font directly from memory through public APIs such as `tvg::Text::load` causes an out-of-bounds read. Loading through a file path using `mmap` can mask the read because of page alignment; the memory-loading API directly exposes it. Depending on memory layout, a malformed short font may crash the consuming application or disclose adjacent heap memory. This issue is fixed in version 1.0.7."}], "source": {"advisory": "GHSA-crfw-c34f-vqrj", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/thorvg/thorvg/security/advisories/GHSA-crfw-c34f-vqrj", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-02T19:46:00.737335Z", "id": "CVE-2026-58496", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T19:46:26.453Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-58496", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-02T19:46:00.737335Z"}}}], "references": [{"url": "https://github.com/thorvg/thorvg/security/advisories/GHSA-crfw-c34f-vqrj", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T19:46:22.007Z"}}], "cna": {"title": "ThorVG: Out-of-bounds Read in SFNT/TTF Font Loader via Memory API", "source": {"advisory": "GHSA-crfw-c34f-vqrj", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "thorvg", "product": "thorvg", "versions": [{"status": "affected", "version": "< 1.0.7"}]}], "references": [{"url": "https://github.com/thorvg/thorvg/security/advisories/GHSA-crfw-c34f-vqrj", "name": "https://github.com/thorvg/thorvg/security/advisories/GHSA-crfw-c34f-vqrj", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/thorvg/thorvg/commit/1dc232a33535946b5eed5fd65e993b13226da0ca", "name": "https://github.com/thorvg/thorvg/commit/1dc232a33535946b5eed5fd65e993b13226da0ca", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/thorvg/thorvg/releases/tag/v1.0.7", "name": "https://github.com/thorvg/thorvg/releases/tag/v1.0.7", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.0.7, the `SFNT/TTF` font loader's `SfntLoader::gen` function in `tvgSfntLoader.cpp` reads `data[0] through data[3]` to identify the font type without first checking that the input buffer contains at least four bytes. Loading an undersized font directly from memory through public APIs such as `tvg::Text::load` causes an out-of-bounds read. Loading through a file path using `mmap` can mask the read because of page alignment; the memory-loading API directly exposes it. Depending on memory layout, a malformed short font may crash the consuming application or disclose adjacent heap memory. This issue is fixed in version 1.0.7."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125: Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-27T22:18:34.301Z"}}}, "cveMetadata": {"cveId": "CVE-2026-58496", "state": "PUBLISHED", "dateUpdated": "2026-11-02T19:46:26.453Z", "dateReserved": "2026-06-30T20:21:25.813Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-27T22:18:34.301Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "thorvg", "vendor": "thorvg", "versions": [{"status": "affected", "version": "< 1.0.7"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.0.7, the `SFNT/TTF` font loader's `SfntLoader::gen` function in `tvgSfntLoader.cpp` reads `data[0] through data[3]` to identify the font type without first checking that the input buffer contains at least four bytes. Loading an undersized font directly from memory through public APIs such as `tvg::Text::load` causes an out-of-bounds read. Loading through a file path using `mmap` can mask the read because of page alignment; the memory-loading API directly exposes it. Depending on memory layout, a malformed short font may crash the consuming application or disclose adjacent heap memory. This issue is fixed in version 1.0.7."}], "id": "CVE-2026-58496", "lastModified": "2026-11-02T20:17:46.827", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58496", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-02T19:46:00.737335Z", "version": "2.0.3"}}]}, "published": "2026-10-27T23:17:06.420", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/thorvg/thorvg/commit/1dc232a33535946b5eed5fd65e993b13226da0ca"}, {"source": "security-advisories@github.com", "url": "https://github.com/thorvg/thorvg/releases/tag/v1.0.7"}, {"source": "security-advisories@github.com", "url": "https://github.com/thorvg/thorvg/security/advisories/GHSA-crfw-c34f-vqrj"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/thorvg/thorvg/security/advisories/GHSA-crfw-c34f-vqrj"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "thorvg: thorvg: Information disclosure via undersized font data", "id": "2562453", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562453"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-125", "details": ["Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.0.7, the `SFNT/TTF` font loader's `SfntLoader::gen` function in `tvgSfntLoader.cpp` reads `data[0] through data[3]` to identify the font type without first checking that the input buffer contains at least four bytes. Loading an undersized font directly from memory through public APIs such as `tvg::Text::load` causes an out-of-bounds read. Loading through a file path using `mmap` can mask the read because of page alignment; the memory-loading API directly exposes it. Depending on memory layout, a malformed short font may crash the consuming application or disclose adjacent heap memory. This issue is fixed in version 1.0.7.", "A flaw was found in ThorVG. The vector graphics engine's font loader does not verify that an input buffer contains the minimum required data before attempting to inspect font headers. An attacker could exploit this flaw by enticing an application to load a specially crafted, undersized font directly into memory. Successful exploitation can result in information disclosure by reading adjacent memory, or cause an application crash leading to a Denial of Service (DoS)."], "name": "CVE-2026-58496", "public_date": "2026-10-27T22:18:34Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-58496\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-58496\nhttps://github.com/thorvg/thorvg/commit/1dc232a33535946b5eed5fd65e993b13226da0ca\nhttps://github.com/thorvg/thorvg/releases/tag/v1.0.7\nhttps://github.com/thorvg/thorvg/security/advisories/GHSA-crfw-c34f-vqrj"], "statement": "This vulnerability is rated as having a Moderate impact because triggering the condition requires user interaction or an application accepting untrusted font payloads, with the impact restricted to minor memory leakage or process termination rather than remote code execution. Furthermore, ThorVG is not distributed in Red Hat Enterprise Linux products, confining exposure to Fedora ecosystem users. In typical deployments where fonts are loaded directly from disk via file paths, system page boundaries may also mitigate out-of-bounds access.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.0.7)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "thorvg", "source": "cna", "vendor": "thorvg"}, "product": "thorvg", "vendor": "thorvg"}], "created": "2026-10-28T00:00:22.675945+00:00", "updated": "2026-10-28T02:15:07.134564+00:00", "vendors": ["thorvg", "thorvg$PRODUCT$thorvg"]}