EUVD-2026-18092
GHSA-x46x-p265-r7jv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability was found in Nothings stb up to 1.26. Impacted is the function stbtt_InitFont_internal in the library stb_truetype.h of the component TTF File Handler. Performing a manipulation results in out-of-bounds read. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Out-of-bounds read in Nothings stb library up to version 1.26 allows remote attackers to trigger information disclosure via a crafted TTF file processed by the stbtt_InitFont_internal function in stb_truetype.h. Exploitation requires user interaction (opening a malicious font file) and publicly available exploit code exists; however, the vendor has not responded to early disclosure notification.
Technical ContextAI
The vulnerability resides in the stb_truetype.h header library, a single-file font parsing implementation widely embedded in applications requiring TrueType font support. The stbtt_InitFont_internal function performs TTF file parsing without sufficient bounds checking, leading to out-of-bounds memory reads (CWE-125: Out-of-bounds Read). An attacker crafting a malicious TTF file with invalid offset or length values can cause the parser to read beyond allocated buffer boundaries, exposing adjacent process memory. The stb library is a popular header-only C library used in game engines, graphics applications, and multimedia software, meaning affected applications may number in the thousands across diverse industries.
RemediationAI
No vendor-released patch has been made available as the developer did not respond to early disclosure efforts. Affected applications should audit their inclusion of stb_truetype.h and either update to a patched fork (if available from the application vendor), implement strict TTF file validation before parsing, restrict TTF file parsing to trusted sources, or sandbox font processing in a restricted security context. Users of applications embedding stb should contact the application vendor for patched builds, as the upstream stb repository may not receive timely updates. The public exploit is available at https://gist.github.com/d0razi/cb31a92f3205a4373f19b7da25946848 for security testing purposes.
stb_image.h (aka the stb image loader) 2.23 has a heap-based buffer over-read in stbi__tga_load, leading to Information
STB v2.27 was discovered to contain an integer shift of invalid size in the component stbi__jpeg_decode_block_prog_ac. R
Buffer overflow vulnerability in function stbi__extend_receive in stb_image.h in stb 2.26 via a crafted JPEG file. Rated
Out-of-bounds write in Nothings stb library up to version 1.22 allows remote attackers to corrupt memory and potentially
Resource exhaustion in Nothings stb library versions up to 1.22 allows unauthenticated remote attackers to cause denial
Denial of service vulnerability in Nothings stb image library (stb_image.h) affecting GIF decoder function stbi__gif_loa
Double free vulnerability in Nothings stb library (up to version 2.30) in the multi-frame GIF file handler function stbi
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today