The vulnerability in Thor Vector Graphics (ThorVG) is a null pointer dereference in the SvgLoader::run() function. When an attacker supplies an untrusted SVG file containing a crafted 6‑byte payload, a call to Picture::load() will trigger a crash of the hosting process. The flaw does not provide code execution or information disclosure; the primary consequence is a denial of service by terminating the process that loaded the SVG. This weakness falls under CWE‑476 (NULL Pointer Dereference).

Thor Vector Graphics engine, distributed under the package name thorvg:thorvg. All releases prior to version 1.0.5 are affected. Version 1.0.5 and newer contain the fix and are not vulnerable.

The CVSS score of 4.3 indicates moderate severity. No EPSS score is available, and the issue is not listed in CISA's KEV catalog, which suggests a low to moderate likelihood of widespread exploitation. The attack vector is inferred to be any client or service that accepts untrusted SVG data and forwards it to Picture::load(). If such SVG input originates from remote users, the vulnerability could be triggered in a remote context, leading to a crash of the affected process. The lack of privilege escalation or data compromise limits the damage to availability only.