Threats affecting pkg:github/thorvg/thorvg

ThorVG versions prior to 1.0.7 contain an out-of-bounds read vulnerability in the SFNT/TTF font loader. The function SfntLoader::gen reads the first four bytes of the input buffer without verifying its size, which can lead to reading beyond the buffer when loading undersized fonts from memory. This may cause application crashes or disclosure of adjacent heap memory. The issue is fixed in version 1.0.7.