EUVD-2026-18109Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 4.0 vector indicates network-accessible attack surface (AV:N) with low attack complexity (AC:L), no privileges required (PR:N), but requiring user interaction (UI:P). The availability impact is low (VA:L) with no confidentiality or integrity impact scored (VC:N, VI:N), though an out-of-bounds read inherently risks information disclosure. The EPSS score shows E:P (exploit POC exists), elevating practical exploitation likelihood above baseline CVSS. However, real-world risk is tempered by the user interaction requirement-an attacker must socially engineer a target into opening a malicious font file within an application using the vulnerable stb_truetype.h parser. The absence of code execution or data modification capabilities limits impact, making this a reconnaissance or denial-of-service vector rather than critical system compromise. Applications embedding stb with automatic font loading (e.g., game engines, document renderers) without explicit user warnings face higher risk than those with manual file selection. |
| Exploit ScenarioDerived | An attacker crafts a malicious TTF font file with corrupted buffer offset values and distributes it via email, a compromised website, or a trojanized software package. When a user opens the file in a vulnerable application (e.g., a document viewer, font preview tool, or game that loads custom assets), the stbtt__buf_get8 function attempts to read at an invalid offset, causing an out-of-bounds memory read. Publicly disclosed exploit code exists, enabling low-skill attackers to automate malformed TTF generation. The attacker can extract sensitive data from adjacent memory regions, or crash the application to establish a foothold for social engineering follow-up attacks. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 02, 2026
Out-of-bounds read in Nothings stb library (stb_truetype.h) up to version 1.26 allows remote attackers to trigger memory access violations via malformed TTF font files, resulting in information disclosure. The vulnerability affects the stbtt__buf_get8 function in the TTF file handler and requires user interaction to exploit. Publicly available exploit code exists, though the vendor has not responded to disclosure notifications. CVSS 5.3 with EPSS probability of exploitation (E:P) indicates moderate real-world risk.
RemediationAI
Update the stb library to a version newer than 1.26 that incorporates bounds checking fixes in stbtt__buf_get8. For applications unable to update immediately, implement external validation of TTF files before parsing by restricting font file sources to trusted repositories and disabling automatic font loading from untrusted sources. Review application code to ensure user-supplied font files are validated against file type signatures and size limits before stb_truetype.h processing. The vendor (Nothings/Sean Barrett) did not provide a coordinated patch timeline per disclosure data; monitor the official stb GitHub repository (https://github.com/nothings/stb) for updates and apply promptly.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The stb library is a single-header C library collection widely used for graphics, audio, and file format processing. The vulnerability resides in stb_truetype.h, a TrueType font parsing module that lacks proper bounds validation in the stbtt__buf_get8 function when reading binary TTF file data. The root cause is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), specifically an out-of-bounds read condition where the function fails to validate buffer offsets before attempting byte-level reads. This allows an attacker to craft a malicious TTF file with invalid offset values, causing the parser to read beyond allocated memory regions and potentially leak sensitive data from adjacent memory.
Know when Stb Truetype H gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was determined in Nothings stb up to 1.26. The affected element is the function stbtt__buf_get8 in the library stb_truetype.h of the component TTF File Handler. Executing a manipulation can lead to out-of-bounds read. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Related Vulnerabilities in Nothings stb Library Memory Safety Flaws
View all 3More in Stb Truetype H
View allstb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_get_index. Rated high severity (CVSS 8.8), this v
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_peek8. Rated high severity (CVSS 8.8), t
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in ttUSHORT. Rated high severity (CVSS 8.8), this vuln
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_get8. Rated high severity (CVSS 8.8), th
stb stb_truetype.h through 1.22 has an assertion failure in stbtt__buf_seek. Rated high severity (CVSS 8.8), this vulner
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__find_table. Rated high severity (CVSS 8.8),
stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_int. Rated high severity (CVSS 8.8), this vulnera
stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttUSHORT() at stb_truetype.h. Rat
stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function stbtt__find_table at stb_truetype
stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttULONG() at stb_truetype.h. Rate
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allVendor StatusVendor
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 0.0~git20200713.b42009b+ds-1 | - |
| bullseye (security) | vulnerable | 0.0~git20200713.b42009b+ds-1+deb11u1 | - |
| bookworm | vulnerable | 0.0~git20220908.8b5f1f3+ds-1 | - |
| trixie | vulnerable | 0.0~git20241109.5c20573+ds-1 | - |
| forky, sid | vulnerable | 0.0~git20250907.fede005+ds-1 | - |
| (unstable) | fixed | (unfixed) | - |
Exploit-DB