EUVD-2026-54489
GHSA-fhqp-xwqm-2m94
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Malicious TTF must reach local filesystem (AV:L, UI:R); attacker needs no system privileges to craft or deliver the file (PR:N); overflow enables heap read (C:H) and crash (A:H) with no write primitive (I:N).
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
4DescriptionCVE.org
A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbtt__GetGlyphShapeTT() function within the nothings stb_truetype.h library when parsing malformed TTF (TrueType Font) files. The vulnerability resides in the glyph data parsing path.
An attacker can craft a malformed TTF file with an inflated endPtsOfContours value and truncate the remaining glyph data. When an application utilizing stb_truetype.h (such as various game engines or graphics software) attempts to load, bake, or render this malformed font via stbtt_GetGlyphShape(), the parser will attempt to read past the end of the glyph data buffer, triggering the out-of-bounds read.
AnalysisAI
Heap buffer overflow in stb_truetype.h (nothings stb, up to version 1.26) allows a local attacker to trigger out-of-bounds heap reads by supplying a crafted TTF font file with an inflated endPtsOfContours value and truncated glyph data. Any application statically embedding this library - including game engines and graphics software - that loads attacker-controlled fonts via stbtt_GetGlyphShape() is exposed to potential heap memory disclosure and application crash. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the target application statically embeds stb_truetype.h at version 1.26 or earlier; (2) the application loads TTF font files from an attacker-controllable source - such as user-uploaded fonts, downloaded game assets, or file paths passed as arguments; and (3) a user or automated process actively triggers font loading (UI:R per CVSS vector - passive presence of the file is insufficient). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H) scores 7.1 and indicates a local attack requiring user interaction - the malicious TTF file must reach the local filesystem and be opened by the target application. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to update the embedded stb_truetype.h to a version that addresses this overflow - monitor https://github.com/nothings/stb/issues/1905 for patch availability, as no independently confirmed patched tagged release version was present in the source data at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a code inventory and dependency audit to identify all applications and third-party tools using stb_truetype versions 1.26 or earlier. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today