FKIE_CVE-2026-18497

Vulnerability from fkie_nvd - Published: 2026-08-07 15:16 - Updated: 2026-10-23 21:10
Severity
7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Summary
A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbtt__GetGlyphShapeTT() function within the nothings stb_truetype.h library when parsing malformed TTF (TrueType Font) files. The vulnerability resides in the glyph data parsing path. An attacker can craft a malformed TTF file with an inflated endPtsOfContours value and truncate the remaining glyph data. When an application utilizing stb_truetype.h (such as various game engines or graphics software) attempts to load, bake, or render this malformed font via stbtt_GetGlyphShape(), the parser will attempt to read past the end of the glyph data buffer, triggering the out-of-bounds read.
References
cret@cert.orghttps://cwe.mitre.org/data/definitions/122.html
cret@cert.orghttps://github.com/nothings/stb
cret@cert.orghttps://github.com/nothings/stb/issues/1905
cret@cert.orghttps://kb.cert.org/vuls/id/987105
af854a3a-2127-422b-91ae-364da2661108https://www.kb.cert.org/vuls/id/987105
134c704f-9b21-4f2e-91b3-4a467353bcc0https://github.com/nothings/stb/issues/1905
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "nothings stb",
          "vendor": "Sean Barrett (nothings)",
          "versions": [
            {
              "status": "affected",
              "version": "1.26"
            }
          ]
        }
      ],
      "source": "cret@cert.org"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbtt__GetGlyphShapeTT() function within the nothings stb_truetype.h library when parsing malformed TTF (TrueType Font) files. The vulnerability resides in the glyph data parsing path.\r\n\r\nAn attacker can craft a malformed TTF file with an inflated endPtsOfContours value and truncate the remaining glyph data. When an application utilizing stb_truetype.h (such as various game engines or graphics software) attempts to load, bake, or render this malformed font via stbtt_GetGlyphShape(), the parser will attempt to read past the end of the glyph data buffer, triggering the out-of-bounds read."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de desbordamiento de b\u00fafer de mont\u00f3n existe en la biblioteca nothings stb TrueType, hasta la versi\u00f3n 1.26, que se utiliza para analizar archivos de fuentes TrueType. La vulnerabilidad existe en la funci\u00f3n stbtt__GetGlyphShapeTT() dentro de la biblioteca nothings stb_truetype.h al analizar archivos TTF (TrueType Font) malformados. La vulnerabilidad reside en la ruta de an\u00e1lisis de datos de glifos.\n\nUn atacante puede crear un archivo TTF malformado con un valor \u2019endPtsOfContours\u2019 inflado y truncar los datos de glifo restantes. Cuando una aplicaci\u00f3n que utiliza stb_truetype.h (como varios motores de juego o software gr\u00e1fico) intenta cargar, generar o renderizar esta fuente malformada a trav\u00e9s de stbtt_GetGlyphShape(), el analizador intentar\u00e1 leer m\u00e1s all\u00e1 del final del b\u00fafer de datos de glifos, lo que activar\u00e1 la lectura fuera de l\u00edmites."
    }
  ],
  "id": "CVE-2026-18497",
  "lastModified": "2026-10-23T21:10:00.157",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.2,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-18497",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-07T17:58:51.313628Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-07T15:16:59.707",
  "references": [
    {
      "source": "cret@cert.org",
      "url": "https://cwe.mitre.org/data/definitions/122.html"
    },
    {
      "source": "cret@cert.org",
      "url": "https://github.com/nothings/stb"
    },
    {
      "source": "cret@cert.org",
      "url": "https://github.com/nothings/stb/issues/1905"
    },
    {
      "source": "cret@cert.org",
      "url": "https://kb.cert.org/vuls/id/987105"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.kb.cert.org/vuls/id/987105"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/nothings/stb/issues/1905"
    }
  ],
  "sourceIdentifier": "cret@cert.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-122"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.