Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.0.7, the SFNT/TTF font loader's SfntLoader::gen function in tvgSfntLoader.cpp reads data[0] through data[3] to identify the font type without first checking that the input buffer contains at least four bytes. Loading an undersized font directly from memory through public APIs such as tvg::Text::load causes an out-of-bounds read. Loading through a file path using mmap can mask the read because of page alignment; the memory-loading API directly exposes it. Depending on memory layout, a malformed short font may crash the consuming application or disclose adjacent heap memory. This issue is fixed in version 1.0.7.
Exploitability
AV:NAC:LPR:NUI:RScope
S:UImpact
C:LI:NA:N4.3/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NMemory Safety