CVE-2026-18497
Received Received - Intake

Heap-Buffer-Overflow in stb TrueType Library

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: CERT/CC

Description
A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbtt__GetGlyphShapeTT() function within the nothings stb_truetype.h library when parsing malformed TTF (TrueType Font) files. The vulnerability resides in the glyph data parsing path. An attacker can craft a malformed TTF file with an inflated endPtsOfContours value and truncate the remaining glyph data. When an application utilizing stb_truetype.h (such as various game engines or graphics software) attempts to load, bake, or render this malformed font via stbtt_GetGlyphShape(), the parser will attempt to read past the end of the glyph data buffer, triggering the out-of-bounds read.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-18497
EUVD
EUVD-2026-54489

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nothings stb to 1.26 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a heap-buffer-overflow vulnerability in the nothings stb TrueType library up to version 1.26. It occurs in the stbtt__GetGlyphShapeTT() function when parsing malformed TrueType Font (TTF) files. An attacker crafts a TTF file with an inflated endPtsOfContours value and truncated glyph data. When an application using stb_truetype.h processes this file via stbtt_GetGlyphShape(), it reads past the glyph data buffer, causing an out-of-bounds read.

Detection Guidance

To detect this vulnerability, monitor applications using stb_truetype.h for crashes when processing TTF files. Use tools like AddressSanitizer (ASan) to detect heap-buffer-overflows during font parsing. Example command: gcc -fsanitize=address -fno-omit-frame-pointer your_program.c -o your_program && ./your_program <malformed.ttf>. Check for errors like 'heap-buffer-overflow' in logs.

Impact Analysis

This vulnerability can cause application crashes (Denial of Service) or expose adjacent heap memory. Exploitation may lead to information disclosure or arbitrary code execution depending on the application's context and memory layout.

Compliance Impact

This vulnerability primarily causes denial of service via application crashes due to invalid memory access when processing malformed TTF files. It does not directly impact GDPR or HIPAA compliance unless the affected application handles protected data and crashes disrupt services processing such data.

Mitigation Strategies

Immediately stop using stb_truetype.h versions up to 1.26 in production. Monitor the stb GitHub repository for updates and apply patches once available. Validate all TTF files before processing to ensure they are not malformed. Consider switching to alternative font parsing libraries until a fix is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18497. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart