Null Pointer Dereference in Thor Vector Graphics Engine
CVE-2026-45729
4.3MEDIUM
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-45729?
A null pointer dereference vulnerability was identified in the Thor Vector Graphics Engine (ThorVG) prior to version 1.0.5. This vulnerability can cause the engine to crash when untrusted SVG data is processed through the Picture::load() function via the SvgLoader::run(). Attackers can exploit this flaw by delivering a specially crafted SVG file that initiates a crash of the application upon loading. To mitigate this risk, users should upgrade to ThorVG version 1.0.5 or later.
Affected Version(s)
thorvg < 1.0.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.