EUVD-2026-75163
GHSA-fcr4-8hv6-4gw2
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Network delivery of malicious TTF; user must open file (UI:R); impact is crash only, no confidentiality or integrity loss.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
An out-of-bounds read in the stbtt_GetGlyphShape component of nothings stb commit 31c1ad3 allows attackers to cause a Denial of Service (DoS) via sending a crafted TTF file.
AnalysisAI
Out-of-bounds read in stb_truetype's stbtt_GetGlyphShape function enables denial of service against any application that parses attacker-supplied TrueType font files using the nothings/stb library at commit 31c1ad3. The affected function reads glyph outline data from a crafted TTF without sufficient bounds validation, causing an abnormal read that crashes the host application. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target application must (1) be built with stb_truetype at or before commit 31c1ad3, and (2) invoke stbtt_GetGlyphShape on attacker-controlled TrueType font data - meaning the application must accept TTF files from untrusted sources (user uploads, downloaded files, embedded assets, etc.). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) accurately reflects a low-to-medium priority issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consumers of the nothings/stb library should update their vendored copy of stb_truetype.h to a commit that addresses this issue - check the GitHub repository at https://github.com/nothings/stb for commits or pull requests referencing issue #1962 or stbtt_GetGlyphShape bounds validation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today