# CVE-2026-123367: ThorVG heap buffer overflow in JPEG decoder

Source: https://junglewise.ai/threats/cve-2026-123367-thor-vector-graphics-thorvg-is-a-production-ready-vector  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-123367 · Severity: high · CVSS 7.4 · Published 2026-11-09

ThorVG is a vector graphics engine used to render images and animations in applications. A crafted JPEG image can trigger a heap buffer overflow that corrupts memory and crashes the application, affecting both direct JPEG decoding and JPEG images embedded in Lottie animations.

Technologies: [ThorVG](https://junglewise.ai/threats/technologies/thorvg). Vendors: [ThorVG](https://junglewise.ai/threats/vendors/thorvg).

## Quick answers

**Is CVE-2026-123367 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123367 being exploited in the wild.

**How severe is CVE-2026-123367?** High severity, with a CVSS score of 7.4, published 9 November 2026.

**Which products and versions are affected?** ThorVG before 1.1.2.

**Is there a fix for CVE-2026-123367?** Yes: fixed in 1.1.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123367 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-123367?** Check whether you run ThorVG at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.1.2

## Technical details

The bundled jpgd JPEG decoder fails to validate duplicate component selectors in SOS (Start of Scan) scan headers, causing each duplicate to increment the MCU block counter without resizing the heap buffers. An attacker crafts a grayscale JPEG that repeats its component in the SOS header, triggering writes beyond allocated buffer bounds in src/loaders/jpg/tvgJpgd.cpp, resulting in heap memory corruption and process crash.

## Affected products

- ThorVG ThorVG before 1.1.2

## Timeline

- 2026-11-09: disclosed

## References

- [https://github.com/thorvg/thorvg/commit/67680c546d38d817e42eb7583dac8d87a4a319b5](https://github.com/thorvg/thorvg/commit/67680c546d38d817e42eb7583dac8d87a4a319b5)
- [https://github.com/thorvg/thorvg/commit/e740313029dd427d1ebd9f53f300da71363f80ce](https://github.com/thorvg/thorvg/commit/e740313029dd427d1ebd9f53f300da71363f80ce)

## Related threats

- [Thor Vector Graphics out-of-bounds read in SFNT/TTF font loader](https://junglewise.ai/threats/cve-2026-58496-thor-vector-graphics-thorvg-is-a-production-ready-vector-graphics)
- [ThorVG null pointer dereference in SvgLoader](https://junglewise.ai/threats/cve-2026-45729-thorvg-null-pointer-dereference-in-svgloader)