« Volver al listado

CVE-2026-45729

Estado: AplazadaMedia (4.3)—

Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to version 1.0.5, a null pointer dereference in SvgLoader::run() allows any caller that passes untrusted SVG data to Picture::load() to crash the process with a 6-byte payload. This issue has been patched in version 1.0.5.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Thorvg — ThorvgAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-45729",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-45729",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-02T15:31:10.476371Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "thorvg",
          "product": "thorvg",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.0.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-06-01T19:16:53.170",
  "references": [
    {
      "url": "https://github.com/thorvg/thorvg/commit/159f44fd5e3d2eea1b3a70689a894e657e2bb079",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/thorvg/thorvg/pull/4387",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/thorvg/thorvg/releases/tag/v1.0.5",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/thorvg/thorvg/security/advisories/GHSA-f863-8ghq-7h64",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/thorvg/thorvg/security/advisories/GHSA-f863-8ghq-7h64",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to version 1.0.5, a null pointer dereference in SvgLoader::run() allows any caller that passes untrusted SVG data to Picture::load() to crash the process with a 6-byte payload. This issue has been patched in version 1.0.5."
    },
    {
      "lang": "es",
      "value": "Thor Vector Graphics (ThorVG) es un motor de gráficos vectoriales listo para producción. Antes de la versión 1.0.5, una desreferencia de puntero nulo en SvgLoader::run() permite a cualquier llamador que pase datos SVG no confiables a Picture::load() colapsar el proceso con una carga útil de 6 bytes. Este problema ha sido parcheado en la versión 1.0.5."
    }
  ],
  "lastModified": "2026-07-22T08:10:00.117",
  "sourceIdentifier": "security-advisories@github.com"
}