EUVD-2026-54489
GHSA-fhqp-xwqm-2m94
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Malicious TTF must reach local filesystem (AV:L, UI:R); attacker needs no system privileges to craft or deliver the file (PR:N); overflow enables heap read (C:H) and crash (A:H) with no write primitive (I:N).
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
4DescriptionCVE.org
A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbtt__GetGlyphShapeTT() function within the nothings stb_truetype.h library when parsing malformed TTF (TrueType Font) files. The vulnerability resides in the glyph data parsing path.
An attacker can craft a malformed TTF file with an inflated endPtsOfContours value and truncate the remaining glyph data. When an application utilizing stb_truetype.h (such as various game engines or graphics software) attempts to load, bake, or render this malformed font via stbtt_GetGlyphShape(), the parser will attempt to read past the end of the glyph data buffer, triggering the out-of-bounds read.
AnalysisAI
Heap buffer overflow in stb_truetype.h (nothings stb, up to version 1.26) allows a local attacker to trigger out-of-bounds heap reads by supplying a crafted TTF font file with an inflated endPtsOfContours value and truncated glyph data. Any application statically embedding this library - including game engines and graphics software - that loads attacker-controlled fonts via stbtt_GetGlyphShape() is exposed to potential heap memory disclosure and application crash. No public exploit code has been identified and EPSS at 0.16% (5th percentile) indicates low current exploitation probability; no CISA KEV listing confirms no confirmed active exploitation at time of analysis.
Technical ContextAI
stb_truetype.h is a single-file, public-domain C library authored by Sean Barrett (nothings) that parses and rasterizes TrueType fonts; it is commonly statically embedded directly into application source trees rather than linked as a shared library. CWE-122 (Heap-based Buffer Overflow) identifies the root cause: the function stbtt__GetGlyphShapeTT() reads glyph contour point data from a TrueType 'glyf' table entry without validating that the endPtsOfContours field is consistent with the actual buffer length. By inflating endPtsOfContours and truncating the remaining glyph payload, an attacker causes the parser to walk off the end of the heap-allocated glyph buffer. The affected CPE is cpe:2.3:a:sean_barrett_(nothings):nothings_stb:*:*:*:*:*:*:*:*, covering all versions through 1.26 as confirmed by EUVD-2026-54489 and NVD.
RemediationAI
The primary fix is to update the embedded stb_truetype.h to a version that addresses this overflow - monitor https://github.com/nothings/stb/issues/1905 for patch availability, as no independently confirmed patched tagged release version was present in the source data at time of analysis. CERT/CC advisory VU#987105 (https://kb.cert.org/vuls/id/987105) should also be consulted for vendor-specific guidance on downstream applications. As a compensating control, applications should restrict font loading strictly to trusted, internally-controlled TTF files and reject any externally-sourced or user-supplied font input before it reaches stbtt_GetGlyphShape(); this eliminates the attack surface without requiring a library update but may break legitimate user-driven font customization features. If input validation is impractical, process font parsing in a sandboxed subprocess or with memory-safe wrappers to contain the impact of a triggered overflow.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today