CVE-2026-123367

Name of the Vulnerable Software and Affected Versions Thor Vector Graphics (ThorVG) versions prior to 1.1.2

Description The bundled jpgd JPEG decoder fails to properly handle duplicate component selectors in an SOS scan header. This allows a crafted grayscale JPEG to increase the m blocks per mcu value without verifying the buffers sized from the frame components. Consequently, decode paths in src/loaders/jpg/tvgJpgd.cpp can write beyond heap buffers sized for a single component, leading to memory corruption and process crashes. This issue can be triggered via direct JPEG decoding or through JPEG images embedded in Lottie content.

Recommendations Update to version 1.1.2.