# CVE-2026-58496: Thor Vector Graphics out-of-bounds read in SFNT/TTF font loader

Source: https://junglewise.ai/threats/cve-2026-58496-thor-vector-graphics-thorvg-is-a-production-ready-vector-graphics  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-58496 · Severity: medium · CVSS 4.3 · Published 2026-10-27

ThorVG is a vector graphics engine used to render graphics and text in applications. When loading a malformed or undersized font file through its memory-based API, the font loader reads beyond the buffer boundaries without validation, potentially exposing adjacent heap memory or crashing the application.

Technologies: [ThorVG](https://junglewise.ai/threats/technologies/thorvg). Vendors: [ThorVG](https://junglewise.ai/threats/vendors/thorvg).

## Quick answers

**Is CVE-2026-58496 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58496 being exploited in the wild.

**How severe is CVE-2026-58496?** Medium severity, with a CVSS score of 4.3, published 27 October 2026.

**Which products and versions are affected?** ThorVG before 1.0.7.

**Is there a fix for CVE-2026-58496?** Yes: fixed in 1.0.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-58496 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-58496?** Check whether you run ThorVG at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.0.7

## Technical details

The SfntLoader::gen function in tvgSfntLoader.cpp reads bytes 0–3 from an input buffer to identify the font type without first validating that the buffer contains at least 4 bytes. This out-of-bounds read occurs when loading fonts via tvg::Text::load or equivalent APIs; file-based loading with mmap may avoid exposure due to page alignment. An attacker providing a crafted undersized font can trigger information disclosure or denial of service depending on adjacent memory layout.

## Affected products

- ThorVG ThorVG before 1.0.7

## Timeline

- 2026-10-27: disclosed

## References

- [https://github.com/thorvg/thorvg/commit/1dc232a33535946b5eed5fd65e993b13226da0ca](https://github.com/thorvg/thorvg/commit/1dc232a33535946b5eed5fd65e993b13226da0ca)
- [https://github.com/thorvg/thorvg/releases/tag/v1.0.7](https://github.com/thorvg/thorvg/releases/tag/v1.0.7)

## Related threats

- [ThorVG heap buffer overflow in JPEG decoder](https://junglewise.ai/threats/cve-2026-123367-thor-vector-graphics-thorvg-is-a-production-ready-vector)
- [ThorVG null pointer dereference in SvgLoader](https://junglewise.ai/threats/cve-2026-45729-thorvg-null-pointer-dereference-in-svgloader)