CVE-2026-5314
Out-of-Bounds Read in stb_truetype.h Enables Remote Exploit
Publication date: 2026-04-01
Last updated on: 2026-04-30
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nothings | stb_truetype.h | to 1.26 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the function stbtt_InitFont_internal within the stb_truetype.h library, which is part of the TTF File Handler component. It allows an attacker to perform a manipulation that results in an out-of-bounds read. This means the program reads memory outside the intended boundaries, which can lead to unexpected behavior or crashes.
The vulnerability can be exploited remotely, and the exploit code has been made public. The vendor was informed early but did not respond.
How can this vulnerability impact me? :
The vulnerability can lead to an out-of-bounds read, which may cause application crashes or potentially expose sensitive information from memory. Since remote exploitation is possible, attackers could exploit this vulnerability over a network without requiring privileges or user interaction.
However, the CVSS scores indicate a relatively low to moderate severity, with the highest base score being 5.0 (v2.0) and lower scores in newer versions, suggesting limited impact in terms of confidentiality and integrity but some impact on availability.