CVE-2026-79515

Deferred Deferred - Pending Action

Out-of-Bounds Read in stbtruetype via Malicious TTF File

Publication date: 2026-09-09

Last updated on: 2026-09-14

Assigner: MITRE

Description

An out-of-bounds read in the stbtt_GetGlyphShape component of nothings stb commit 31c1ad3 allows attackers to cause a Denial of Service (DoS) via sending a crafted TTF file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-14

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-79515

EUVD

EUVD-2026-75163

Affected Vendors & Products

Vendor	Product	Version / Range
nothings	stb	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is an out-of-bounds read in the stbtt_GetGlyphShape function of the stb library. It occurs when processing a crafted TrueType Font (TTF) file, allowing attackers to cause a Denial of Service (DoS) by crashing the application.

Detection Guidance

This vulnerability involves an out-of-bounds read in stbtt_GetGlyphShape triggered by a crafted TTF file. Detection requires analyzing font files for malformed data. Use tools like 'strings' to inspect TTF files for unusual patterns or fuzzers to generate test cases. No direct commands are provided for detection in the given context.

Impact Analysis

If you process untrusted TTF files, this vulnerability could cause applications using the stb library to crash, leading to service disruption or application downtime. Users may experience unexpected application failures when opening specific font files.

Compliance Impact

This vulnerability causes a Denial of Service (DoS) via crafted TTF files, which could disrupt system availability. For GDPR, availability is part of data integrity and security principles, so prolonged DoS could impact compliance. HIPAA requires safeguards for data availability, so this issue may pose risks if exploited in healthcare systems.

Mitigation Strategies

Update the stb library to a version that fixes the out-of-bounds read in stbtt_GetGlyphShape. Avoid processing untrusted TTF files until patched.

Hi! I’m here to help you understand CVE-2026-79515. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70