CVE-2026-45729: ThorVG Null Pointer Dereference in SVG Parsing (CVSS 4.3)

Technical summary

CVE-2026-45729 is a null pointer dereference vulnerability in the SvgLoader::run() function of ThorVG prior to version 1.0.5. The flaw occurs during SVG parsing when Picture::load() is called with untrusted SVG data. The vulnerability can be triggered with a minimal 6-byte payload, suggesting a simple edge case in the SVG parsing logic that fails to validate or handle a specific malformed structure. The null pointer dereference results in immediate process termination. The vulnerability is classified as CWE-476 (Null Pointer Dereference), a common memory safety issue in C/C++ applications.

Business impact

Organizations embedding ThorVG in applications that accept or render user-supplied SVG content face service availability risks. If an untrusted SVG file can reach a ThorVG-powered renderer—via email attachments, web uploads, design tools, or graphics processing pipelines—an attacker can crash the process. This impacts use cases like web services that convert SVG to raster formats, design collaboration platforms, and embedded graphics applications. The severity is moderated by the requirement that users interact with or process the malicious file (UI interaction is required per the CVSS vector), but in automated or background processing contexts, this requirement may be weaker.

Affected systems

Any application or library that embeds ThorVG versions prior to 1.0.5 and uses Picture::load() to parse SVG data from untrusted sources is affected. This includes applications built on ThorVG for SVG rendering, format conversion, or vector-based UI rendering. The vulnerability is triggered only when SVG data is loaded and parsed; statically compiled SVGs or SVGs from trusted sources pose no risk. Applications using ThorVG 1.0.5 or later are not affected.

Exploitability

Exploitation requires that an attacker can supply SVG data to an application that uses the vulnerable ThorVG version. The attack is highly reliable (low complexity) because the trigger is deterministic: a specific malformed SVG structure causes predictable null pointer dereference. However, successful attack depends on user interaction or application design that processes the SVG (the CVSS vector specifies UI:R). In attended scenarios, an attacker must convince a user to open or process a file. In unattended scenarios (automated SVG processing), the barrier to exploitation is lower. No authentication or privileges are required.

Remediation

Upgrade ThorVG to version 1.0.5 or later. Organizations should audit their software bill of materials (SBOM) to identify applications and libraries that depend on ThorVG and determine their current versions. For applications that cannot be immediately updated, implement input validation and sanitization on SVG files before they are passed to ThorVG—reject or clean SVG documents from untrusted sources. Isolate SVG processing in sandboxed environments if feasible. Monitor application logs for unexpected crashes related to SVG parsing.

Patch guidance

ThorVG 1.0.5 contains the fix for this null pointer dereference. Verify the patch by checking release notes and commit history at the ThorVG project repository. Apply updates to all applications, libraries, and tools that embed ThorVG. If you maintain a custom or bundled version of ThorVG, apply the upstream fix from the 1.0.5 release or cherry-pick the relevant commits. Test SVG rendering with a representative sample of legitimate and edge-case SVG files to ensure the fix does not introduce regressions.

Detection guidance

Monitor for repeated application crashes or process terminations coinciding with SVG file processing. Inspect crash logs and core dumps for stack traces mentioning SvgLoader or Picture::load(). Implement application-level logging to record when SVG files are loaded, especially from untrusted sources. If possible, integrate fuzzing or property-based testing of SVG inputs in your CI/CD pipeline to catch similar issues before they reach production. Network and log monitoring should flag attempts to upload or transmit SVG files to applications known to use vulnerable ThorVG versions.

Why prioritize this

Although this vulnerability is rated MEDIUM severity with a CVSS score of 4.3, it warrants prioritized patching because (1) exploitation is trivial and requires only a 6-byte payload, (2) the fix is available and low-risk (a patched version already exists), and (3) many organizations may be unaware they use ThorVG indirectly through dependencies. The lack of KEV designation suggests limited weaponization or public exploit activity to date, but the low barrier to exploitation and high reliability mean it could be weaponized quickly. Prioritize patching in internet-facing or user-interactive applications that process SVG files.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a network-accessible vulnerability (AV:N) with low attack complexity (AC:L) that requires no privileges or authentication, but causes only availability impact (A:L) and requires user interaction (UI:R). The scope is unchanged (S:U). This scoring appropriately reflects that denial-of-service via SVG parsing is less severe than a confidentiality or integrity breach, but more concerning than a purely local issue. The moderate CVSS score should not downplay the practical importance of patching, given the ease of exploitation and availability of a fix.

Frequently asked questions