stb_truetype CVE-2026-18497

Exploitation requires three concurrent conditions: (1) the target application statically embeds stb_truetype.h at version 1.26 or earlier; (2) the application loads TTF font files from an attacker-controllable source - such as user-uploaded fonts, downloaded game assets, or file paths passed as arguments; and (3) a user or automated process actively triggers font loading (UI:R per CVSS vector - passive presence of the file is insufficient). The attack vector is local (AV:L), meaning the malicious TTF must be accessible on the local filesystem at load time. Exploitation is bounded to heap memory disclosure and application crash; there is no modeled write primitive or integrity impact. Applications that exclusively load fonts from a fixed, internally-bundled, vendor-controlled set are not exploitable, as the attacker cannot inject a malformed file into the load path.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H) scores 7.1 and indicates a local attack requiring user interaction - the malicious TTF file must reach the local filesystem and be opened by the target application. High confidentiality impact reflects potential heap memory disclosure; high availability reflects application crash; no integrity impact is modeled. EPSS at 0.16% (5th percentile) strongly corroborates low current exploitation activity, and the absence of a CISA KEV entry confirms no confirmed in-the-wild exploitation. The primary real-world risk multiplier is the library's broad embedding footprint: because stb_truetype.h is copied directly into application source trees, each consuming application must be independently patched, and vendors may not be aware they are affected. However, the local attack vector and mandatory user interaction substantially limit opportunistic or wormable exploitation. No conflicting signals exist between CVSS, EPSS, and KEV data - the signals are consistent.

An attacker crafts a malformed TTF file with an inflated endPtsOfContours value and deliberately truncated glyph data, then delivers it to a victim as a game asset, document resource, or downloadable font - any mechanism that causes the target application to call stbtt_GetGlyphShape() on the file. When the application processes the font, stbtt__GetGlyphShapeTT() reads beyond the heap-allocated glyph buffer, potentially exposing adjacent heap contents (memory disclosure) or crashing the process. No public proof-of-concept code has been identified, though the GitHub issue (https://github.com/nothings/stb/issues/1905) provides sufficient technical detail to facilitate independent reproduction.