{"id":"CVE-2026-45729","title":"Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine","summary":"Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to version 1.0.5, a null pointer dereference in SvgLoader::run() allows any caller that passes untrusted SVG data to Picture::load() to crash the process w…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","cwe":["CWE-476"],"published":"2026-06-01","updated":"2026-07-22","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45729","references":[{"url":"https://github.com/thorvg/thorvg/commit/159f44fd5e3d2eea1b3a70689a894e657e2bb079","label":"security-advisories@github.com"},{"url":"https://github.com/thorvg/thorvg/pull/4387","label":"security-advisories@github.com"},{"url":"https://github.com/thorvg/thorvg/releases/tag/v1.0.5","label":"security-advisories@github.com"},{"url":"https://github.com/thorvg/thorvg/security/advisories/GHSA-f863-8ghq-7h64","label":"security-advisories@github.com"},{"url":"https://github.com/thorvg/thorvg/security/advisories/GHSA-f863-8ghq-7h64","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","exploit-available"],"epss":0.00235,"epssPercentile":0.14802,"ingestedAt":"2026-07-23T07:14:46.627Z","exploits":{"github":1,"githubRepos":["https://github.com/yeahhbean/CVE-2026-45729"],"checkedAt":"2026-09-23T07:14:06.536Z"},"exploitAvailable":true,"slug":"CVE-2026-45729","body":"## Overview\n\nThor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to version 1.0.5, a null pointer dereference in SvgLoader::run() allows any caller that passes untrusted SVG data to Picture::load() to crash the process with a 6-byte payload. This issue has been patched in version 1.0.5.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":36,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":5243,"id":"CVE-2026-45729","ts":1788887256260,"field":"exploit_available","old":"false","new":"true"},{"seq":4126,"id":"CVE-2026-45729","ts":1788886372668,"field":"exploit_available","old":"true","new":"false"},{"seq":2899,"id":"CVE-2026-45729","ts":1788883038094,"field":"exploit_available","old":"false","new":"true"},{"seq":1928,"id":"CVE-2026-45729","ts":1788882441604,"field":"exploit_available","old":"true","new":"false"},{"seq":1017,"id":"CVE-2026-45729","ts":1788881876436,"field":"exploit_available","old":"false","new":"true"}]}