Thor Vector Graphics: Heap-based buffer overflow in jpgd JPEG decoder (CVE-2026-123367)
The Thor Vector Graphics (ThorVG) engine prior to 1.1.2 contains a heap buffer overflow vulnerability in its bundled jpgd JPEG decoder.
CVE search metadata
CVE search record: CVE-2026-123367. Severity: high. CVSS: 7.4. KEV: no. Product: Thor Vector Graphics (< 1.1.2). Brief: Thor Vector Graphics: Heap-based buffer overflow in jpgd JPEG decoder (CVE-2026-123367). Brief link: https://feed.craftedsignal.io/briefs/2026-11-thorvg-heap-overflow/
Triage facts
Revision 1- Applicability
- Thor Vector Graphics (< 1.1.2)
- Evidence
- Unknown
- Severity
- Low
- Sources
- 1 public source
- Freshness
- Revision 1Nov 9, 21:59 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
In Thor Vector Graphics (ThorVG) prior to version 1.1.2, the bundled jpgd JPEG decoder incorrectly handles duplicate component selectors in the SOS scan header. This error causes an increase in m_blocks_per_mcu without verifying buffers sized for frame components. A crafted grayscale JPEG can leverage this to trigger memory writes beyond heap buffers. This vulnerability is reachable through direct JPEG decoding and JPEG images embedded in Lottie content.
Impact
The confirmed impact is memory corruption followed by a process crash.
Remediation
This issue is fixed in version 1.1.2.