CVE-2026-58496
Description
A flaw was found in ThorVG. The vector graphics engine's font loader does not verify that an input buffer contains the minimum required data before attempting to inspect font headers. An attacker could exploit this flaw by enticing an application to load a specially crafted, undersized font directly into memory. Successful exploitation can result in information disclosure by reading adjacent memory, or cause an application crash leading to a Denial of Service (DoS).
Statement
This vulnerability is rated as having a Moderate impact because triggering the condition requires user interaction or an application accepting untrusted font payloads, with the impact restricted to minor memory leakage or process termination rather than remote code execution. Furthermore, ThorVG is not distributed in Red Hat Enterprise Linux products, confining exposure to Fedora ecosystem users. In typical deployments where fonts are loaded directly from disk via file paths, system page boundaries may also mitigate out-of-bounds access.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
