CVE-2026-123367

Thor Vector Graphics ThorVG is a production-ready vector graphics engine. Prior to 1.1.2, the bundled jpgd JPEG decoder accepts duplicate component selectors in an SOS scan header, causing each duplicate to increase mblockspermcu without checking the buffers sized from the frame components. A...

UBUNTU-CVE-2026-123367

Thor Vector Graphics ThorVG is a production-ready vector graphics engine. Prior to 1.1.2, the bundled jpgd JPEG decoder accepts duplicate component selectors in an SOS scan header, causing each duplicate to increase mblockspermcu without checking the buffers sized from the frame components. A...

CVE-2026-123367

Thor Vector Graphics ThorVG is a production-ready vector graphics engine. Prior to 1.1.2, the bundled jpgd JPEG decoder accepts duplicate component selectors in an SOS scan header, causing each duplicate to increase mblockspermcu without checking the buffers sized from the frame components. A...

DEBIAN-CVE-2026-123367

Thor Vector Graphics ThorVG is a production-ready vector graphics engine. Prior to 1.1.2, the bundled jpgd JPEG decoder accepts duplicate component selectors in an SOS scan header, causing each duplicate to increase mblockspermcu without checking the buffers sized from the frame components. A...

CVE-2026-123367

Thor Vector Graphics ThorVG is a production-ready vector graphics engine. Prior to 1.1.2, the bundled jpgd JPEG decoder accepts duplicate component selectors in an SOS scan header, causing each duplicate to increase mblockspermcu without checking the buffers sized from the frame components. A...

CVE-2026-123367 ThorVG: Heap buffer overflow (OOB write) in bundled jpgd JPEG decoder

Thor Vector Graphics ThorVG is a production-ready vector graphics engine. Prior to 1.1.2, the bundled jpgd JPEG decoder accepts duplicate component selectors in an SOS scan header, causing each duplicate to increase mblockspermcu without checking the buffers sized from the frame components. A...

CVE-2026-123367

The Thor Vector Graphics (ThorVG) engine contains a heap buffer overflow (CWE-787) in its bundled jpgd JPEG decoder prior to version 1.1.2 . The root cause is that the decoder accepts duplicate component selectors in an SOS scan header, increasing m_blocks_per_mcu without verifying the buffer siz...

CVE-2026-123367 ThorVG: Heap buffer overflow (OOB write) in bundled jpgd JPEG decoder

Thor Vector Graphics ThorVG is a production-ready vector graphics engine. Prior to 1.1.2, the bundled jpgd JPEG decoder accepts duplicate component selectors in an SOS scan header, causing each duplicate to increase mblockspermcu without checking the buffers sized from the frame components. A...

CVE-2026-123367 ThorVG: Heap buffer overflow (OOB write) in bundled jpgd JPEG decoder

Thor Vector Graphics ThorVG is a production-ready vector graphics engine. Prior to 1.1.2, the bundled jpgd JPEG decoder accepts duplicate component selectors in an SOS scan header, causing each duplicate to increase mblockspermcu without checking the buffers sized from the frame components. A...

Linux Distros Unpatched Vulnerability : CVE-2026-123367

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Thor Vector Graphics ThorVG is a production-ready vector graphics engine. Prior to 1.1.2, the bundled jpgd JPEG decoder accepts duplicate component selectors in...

CVE-2026-123367: thorvg: Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine

Thor Vector Graphics ThorVG is a production-ready vector graphics engine. Prior to 1.1.2, the bundled jpgd JPEG decoder accepts duplicate component selectors in an SOS scan header, causing each duplicate to increase mblockspermcu without checking the buffers sized from the frame components. A...

PT-2026-140456

Thor Vector Graphics ThorVG is a production-ready vector graphics engine. Prior to 1.1.2, the bundled jpgd JPEG decoder accepts duplicate component selectors in an SOS scan header, causing each duplicate to increase m blocks per mcu without checking the buffers sized from the frame components. A...

CVE-2026-112403

A flaw was found in Pillow. A remote attacker could exploit this vulnerability to achieve arbitrary code execution or cause a Denial of Service DoS by supplying a specially crafted lossless JPEG image to an application that downscales images or generates thumbnails. This issue occurs because the...

PT-2026-123475

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's actual output width and component count after scaling is requested, and an 8-bit lossless SOF3 JP...

Pillow 12.3.0 JPEG Decoder Heap Buffer Overflow

Pillow version 12.3.0 and earlier contain a heap buffer overflow in ImagingJpegDecode when thumbnail processes an 8-bit lossless SOF3 JPEG with libjpeg-turbo 3.x. https://packetstorm.news/download/237261...

SUSE CVE-2026-92454

The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what it reads. A truncated segment is therefore read past the end of the caller's image buffer. Separately, a zero chroma sampling factor makes the block decode loop non-terminating...

SUSE CVE-2026-112403

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's actual output width and component count after scaling is requested, and an 8-bit lossless SOF3 JP...

Linux Distros Unpatched Vulnerability : CVE-2026-109269

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the JPEG decoder, which performs a read that exposes...

EUVD-2026-104642

Pillow: Heap buffer overflow in ImagingJpegDecode...

CVE-2026-92454

The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what it reads. A truncated segment is therefore read past the end of the caller's image buffer. Separately, a zero chroma sampling factor makes the block decode loop non-terminating...