CVE-2026-45729: ThorVG Vector Graphics Engine DoS Flaw

CVE-2026-45729 Overview

CVE-2026-45729 is a null pointer dereference vulnerability in Thor Vector Graphics (ThorVG), a production-ready vector graphics engine. The flaw exists in the SvgLoader::run() function in versions prior to 1.0.5. Any caller that passes untrusted SVG data to Picture::load() can crash the host process using a 6-byte payload. The issue is tracked under [CWE-476] and was addressed in ThorVG version 1.0.5.

Critical Impact
A 6-byte malicious SVG payload triggers a null pointer dereference, crashing any application that loads untrusted SVG content through ThorVG.

Affected Products

Thor Vector Graphics (ThorVG) versions prior to 1.0.5
Applications embedding ThorVG for SVG rendering
Downstream projects consuming ThorVG via Picture::load()

Discovery Timeline

2026-06-01 - CVE-2026-45729 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-45729

Vulnerability Analysis

ThorVG parses SVG documents through its SvgLoader component. When an application calls Picture::load() with attacker-controlled SVG data, execution reaches SvgLoader::run(). In versions prior to 1.0.5, this function fails to validate an internal pointer before dereferencing it. The result is a process crash on a minimal, 6-byte input.

The vulnerability does not require authentication or elevated privileges. It does require user interaction in the form of opening or rendering the malicious SVG. The impact is limited to availability — no memory disclosure or code execution has been reported. The advisory is published under GitHub Security Advisory GHSA-f863-8ghq-7h64.

Root Cause

The root cause is missing null pointer validation inside SvgLoader::run(). The loader assumes that an internal SVG parser state pointer is initialized before use. A malformed 6-byte SVG payload bypasses initialization paths, leaving the pointer null. Dereferencing this pointer terminates the process. The fix in GitHub Pull Request #4387 adds the missing guard before the dereference.

Attack Vector

The attack vector is network-reachable but requires user interaction. An attacker hosts or delivers a crafted SVG file to an application that uses ThorVG for rendering. Distribution paths include web pages, document viewers, messaging clients, and game engines that embed the library. When the victim opens or previews the SVG, Picture::load() invokes the vulnerable loader and the host process crashes. Repeated delivery can produce a sustained denial of service on services that automatically render SVG uploads.

No verified proof-of-concept code is published in the referenced sources. Technical details are documented in the GitHub Commit.

Detection Methods for CVE-2026-45729

Indicators of Compromise

Unexpected crashes or segmentation faults in processes that load SVG content through ThorVG
Application logs showing failures originating in SvgLoader::run() or Picture::load()
Repeated delivery of very small SVG files (approximately 6 bytes) from a single source
Crash dumps referencing a null address dereference inside the ThorVG module

Detection Strategies

Inventory all applications and container images that statically or dynamically link ThorVG versions earlier than 1.0.5
Monitor process telemetry for repeated abnormal terminations of services that handle user-supplied SVG input
Inspect web upload pipelines and email gateways for anomalously small SVG attachments
Correlate crash events with the source of recently rendered SVG assets

Monitoring Recommendations

Enable crash reporting on SVG rendering services and forward dumps to centralized analysis
Track ThorVG library versions across endpoints and build artifacts through software composition analysis
Alert on repeated Picture::load() failures within short time windows from the same client or upload source

How to Mitigate CVE-2026-45729

Immediate Actions Required

Upgrade ThorVG to version 1.0.5 or later in all applications and container images
Rebuild and redeploy downstream software that statically links ThorVG
Restrict acceptance of untrusted SVG content in services that cannot be patched immediately
Validate SVG file size and structure at the application boundary before invoking Picture::load()

Patch Information

The vulnerability is patched in ThorVG 1.0.5, available via GitHub Release v1.0.5. The corresponding code change is documented in GitHub Commit 159f44f and merged through Pull Request #4387. The fix adds the missing null pointer check in SvgLoader::run().

Workarounds

Disable SVG rendering paths in affected applications until the patched library is deployed
Pre-validate SVG payloads with an independent parser and reject malformed or undersized files
Sandbox or isolate processes that render untrusted SVG content so crashes do not affect parent services
Block SVG uploads at perimeter controls for services that do not require them

bash

# Verify and upgrade ThorVG to the patched version
git clone https://github.com/thorvg/thorvg.git
cd thorvg
git checkout v1.0.5
meson setup build
ninja -C build install