Executive brief
ThorVG is a vector graphics engine used by platforms like Samsung Tizen OS and the Godot Engine to render images. A vulnerability in how it handles SVG files allows an attacker to crash any application using the library by providing a specially crafted, 6-byte malformed image file. This results in a denial-of-service (DoS) where the application stops functioning, though it does not appear to lead to data theft or unauthorized access.
Technical details
A NULL pointer dereference exists in the `SvgLoader::run()` function within `src/loaders/svg/tvgSvgLoader.cpp`. The vulnerability occurs because the engine fails to validate the return value of `svgSceneBuild()` when processing malformed SVG data. If `svgSceneBuild()` returns a null pointer due to parsing failure, the subsequent call to `root->ref()` triggers a segmentation fault. An attacker can exploit this by passing a minimal 6-byte malformed SVG string (e.g., `<svg><`) to the `Picture::load()` API. This issue affects applications integrating ThorVG, such as the Godot Engine and LVGL. The vulnerability was discovered via fuzzing and is fixed in version 1.0.5 by adding appropriate null checks.
Affected products
- Thor Vector Graphics ThorVG < 1.0.5
Timeline
- 2026-05-12: advisory: Internal GHSA advisory published
- 2026-05-12: patched: Fix committed to main branch
- 2026-05-15: other: Version 1.0.5 released
- 2026-06-01: disclosed: CVE-2026-45729 published