https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-27T12:02:24.188025+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-351445 EUVD-2026-351445 2026-10-27T12:02:24.190783+00:00 EUVD-2026-351445 https://cve.radiocsirt.org/vuln/fkie_cve-2026-18497 fkie_cve-2026-18497 2026-10-27T12:02:24.190813+00:00

A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbtt__GetGlyphShapeTT() function within the nothings stb_truetype.h library when parsing malformed TTF (TrueType Font) files. The vulnerability resides in the glyph data parsing path. An attacker can craft a malformed TTF file with an inflated endPtsOfContours value and truncate the remaining glyph data. When an application utilizing stb_truetype.h (such as various game engines or graphics software) attempts to load, bake, or render this malformed font via stbtt_GetGlyphShape(), the parser will attempt to read past the end of the glyph data buffer, triggering the out-of-bounds read.

 https://cve.radiocsirt.org/vuln/ghsa-fhqp-xwqm-2m94 GHSA-fhqp-xwqm-2m94 2026-10-27T12:02:24.190846+00:00

A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbtt__GetGlyphShapeTT() function within the nothings stb_truetype.h library when parsing malformed TTF (TrueType Font) files. The vulnerability resides in the glyph data parsing path.

An attacker can craft a malformed TTF file with an inflated endPtsOfContours value and truncate the remaining glyph data. When an application utilizing stb_truetype.h (such as various game engines or graphics software) attempts to load, bake, or render this malformed font via stbtt_GetGlyphShape(), the parser will attempt to read past the end of the glyph data buffer, triggering the out-of-bounds read.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-18497 UBUNTU-CVE-2026-18497 2026-10-27T12:02:24.190867+00:00

Affected: Ubuntu:20.04:LTS: libstb, Ubuntu:22.04:LTS: libstb, Ubuntu:24.04:LTS: libstb, Ubuntu:26.10: libstb, Ubuntu:26.04:LTS: libstb

A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbtt__GetGlyphShapeTT() function within the nothings stb_truetype.h library when parsing malformed TTF (TrueType Font) files. The vulnerability resides in the glyph data parsing path. An attacker can craft a malformed TTF file with an inflated endPtsOfContours value and truncate the remaining glyph data. When an application utilizing stb_truetype.h (such as various game engines or graphics software) attempts to load, bake, or render this malformed font via stbtt_GetGlyphShape(), the parser will attempt to read past the end of the glyph data buffer, triggering the out-of-bounds read.