ThorVG CVE-2026-58496

Exploitation requires the consuming application to load an attacker-controlled font payload smaller than four bytes directly from memory through ThorVG's public memory-loading API (e.g., tvg::Text::load(..., data, size, "ttf", true)) in a version prior to 1.0.7. A key limiting factor: loading the same malformed font via a file path uses mmap, whose page alignment typically masks the over-read, so the file-path code path is not reliably affected - the vulnerability is specifically exposed through the in-memory API. Impact is further limited to adjacent heap disclosure or a crash (no code execution), and the app must actually accept and parse untrusted font bytes; the NVD vector additionally marks UI:R, implying some victim interaction in that assessment.

This is a genuine but modest-priority issue, not a high-urgency emergency. The CWE-125 out-of-bounds read yields only limited impact: adjacent heap disclosure (C:L) or an application crash. There is a notable discrepancy in the severity signals - the NVD-style input vector is CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) with UI:R, while the vendor's GHSA advisory rates it 5.3 with UI:N (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N); the difference hinges on whether victim interaction is required, which realistically depends on how the consuming application feeds data to the memory-loading API. No EPSS score and no KEV listing were provided in the input, so there is no signal of active or probable exploitation - exploitation status is 'no public exploit identified at time of analysis' in the strict sense, but note the GHSA advisory ships a documented reproduction (1-byte payload, ASan-caught) and an attached thorvg.zip, so a public PoC reference exists; it is not verified as working exploit code. The vuln.today Decision label is 'this_month', consistent with a patch-on-normal-cadence posture rather than act_now. Net: real and worth patching this month, but the limited technical impact (no code execution, no integrity impact, PR:N but memory-API-dependent) keeps it well below critical.

An application using ThorVG < 1.0.7 accepts attacker-controlled font bytes (for example, an embedded TTF/OTF in a web-rendered animation or document) and passes them to the in-memory loader via tvg::Text::load. The attacker supplies a buffer shorter than four bytes, causing SfntLoader::gen to read past the allocation while checking the font-type magic, which can crash the process or leak adjacent heap data. A public PoC reference exists (documented reproduction steps plus an attached archive in the GHSA advisory); it is not verified as working exploit code.