Is CVE-2026-45729 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45729 being exploited in the wild.

How severe is CVE-2026-45729?

Medium severity, with a CVSS score of 4.3, published 1 June 2026.

Is there a fix for CVE-2026-45729?

A patch was published on 2026-05-12: Fix committed to main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45729 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-45729?

Check whether you run ThorVG at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45729: ThorVG null pointer dereference in SvgLoader

CVE-2026-45729 · Severity: medium · CVSS 4.3 · Published 2026-06-01

ThorVG is a vector graphics engine used by platforms like Samsung Tizen OS and the Godot Engine to render images. A vulnerability in how it handles SVG files allows an attacker to crash any application using the library by providing a specially crafted, 6-byte malformed image file. This results in a denial-of-service (DoS) where the application stops functioning, though it does not appear to lead to data theft or unauthorized access.

Technologies: ThorVG. Vendors: ThorVG.

Quick answers

Is CVE-2026-45729 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45729 being exploited in the wild.
How severe is CVE-2026-45729?: Medium severity, with a CVSS score of 4.3, published 1 June 2026.
Which products and versions are affected?: ThorVG < 1.0.5.
Is there a fix for CVE-2026-45729?: A patch was published on 2026-05-12: Fix committed to main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45729 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-45729?: Check whether you run ThorVG at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A NULL pointer dereference exists in the `SvgLoader::run()` function within `src/loaders/svg/tvgSvgLoader.cpp`. The vulnerability occurs because the engine fails to validate the return value of `svgSceneBuild()` when processing malformed SVG data. If `svgSceneBuild()` returns a null pointer due to parsing failure, the subsequent call to `root->ref()` triggers a segmentation fault. An attacker can exploit this by passing a minimal 6-byte malformed SVG string (e.g., `<svg><`) to the `Picture::load()` API. This issue affects applications integrating ThorVG, such as the Godot Engine and LVGL. The vulnerability was discovered via fuzzing and is fixed in version 1.0.5 by adding appropriate null checks.

Affected products

Thor Vector Graphics ThorVG < 1.0.5

Timeline

2026-05-12: advisory: Internal GHSA advisory published
2026-05-12: patched: Fix committed to main branch
2026-05-15: other: Version 1.0.5 released
2026-06-01: disclosed: CVE-2026-45729 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.