CVE-2026-45729 ThorVG: Null pointer dereference in SVG loader causes crash via 6-byte malformed input
An attacker can crash applications using ThorVG by providing a small malformed SVG file, causing a null pointer dereference.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-45729?
CVE-2026-45729 is a medium-severity vulnerability in thorvg, published on 1 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to version 1.0.5, a null pointer dereference in SvgLoader::run() allows any caller that passes untrusted SVG data to Picture::load() to crash the process with a 6-byte payload. This issue has been patched in version 1.0.5.
Weakness: CWE-476
Which versions are affected by CVE-2026-45729?
How do I fix CVE-2026-45729?
Upgrade to a fixed version.
Is CVE-2026-45729 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45729 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as DEBIAN-CVE-2026-45729, GHSA-f863-8ghq-7h64, UBUNTU-CVE-2026-45729.