CVE-2026-123367

Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.1.2, the bundled jpgd JPEG decoder accepts duplicate component selectors in an SOS scan header, causing each duplicate to increase m_blocks_per_mcu without checking the buffers sized from the frame components. A crafted grayscale JPEG can repeat its component in the SOS header, causing decode paths in src/loaders/jpg/tvgJpgd.cpp to write beyond heap buffers sized for one component. The issue is reachable through direct JPEG decoding and through JPEG images embedded in Lottie content, and confirmed impact is memory corruption followed by a process crash. This issue is fixed in version 1.1.2.

• CWE-787

• https://github.com/thorvg/thorvg/commit/67680c546d38d817e42eb7583dac8d87a4a319b5
• https://github.com/thorvg/thorvg/commit/e740313029dd427d1ebd9f53f300da71363f80ce
• https://github.com/thorvg/thorvg/releases/tag/v1.1.2
• https://github.com/thorvg/thorvg/security/advisories/GHSA-mw4c-w54x-248r

Published

Nov 9, 2026

Last Modified

Nov 12, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-123338Out-of-bounds Write vulnerability in Apache DataSketches C++…
• CVE-2026-123339Improper trust of forwarded headers in RouterListener::onKer…2.3
• CVE-2026-123341Adobe Experience Manager is affected by a reflected Cross-Si…5.4
• CVE-2026-123356GROBID is machine learning software for extracting informati…7.5
• CVE-2026-123357GROBID is machine learning software for extracting informati…0
• CVE-2026-123364OctoPrint provides a web interface for controlling consumer …2.4
• CVE-2026-123368compose-lint is a Docker Compose security linter that identi…2.3
• CVE-2026-123369compose-lint is a Docker Compose security linter that identi…5.3
• CVE-2026-123370compose-lint is a Docker Compose security linter that identi…5.1
• CVE-2026-123371compose-lint is a Docker Compose security linter that identi…2.3
• CVE-2026-123372compose-lint is a Docker Compose security linter that identi…2.3
• CVE-2026-123373compose-lint is a Docker Compose security linter that identi…2.3