CVE-2026-18497 in nothings stb
Summary
by MITRE • 08/07/2026
A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbtt__GetGlyphShapeTT() function within the nothings stb_truetype.h library when parsing malformed TTF (TrueType Font) files. The vulnerability resides in the glyph data parsing path.
An attacker can craft a malformed TTF file with an inflated endPtsOfContours value and truncate the remaining glyph data. When an application utilizing stb_truetype.h (such as various game engines or graphics software) attempts to load, bake, or render this malformed font via stbtt_GetGlyphShape(), the parser will attempt to read past the end of the glyph data buffer, triggering the out-of-bounds read.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
The heap-buffer-overflow vulnerability in the nothings stb TrueType library represents a critical security flaw that affects applications relying on this widely-used font parsing component. This vulnerability exists in version 1.26 and earlier of the stb_truetype.h library, which is embedded in numerous software systems including game engines, graphics applications, and document processing tools. The flaw stems from inadequate bounds checking during the parsing of TrueType font files, specifically within the stbtt__GetGlyphShapeTT() function that handles glyph data extraction. When a malformed TTF file containing an inflated endPtsOfContours value is processed, the parser attempts to access memory beyond the allocated buffer boundaries, creating a dangerous condition that can be exploited by malicious actors.
The technical implementation of this vulnerability occurs during the glyph data parsing path where the library fails to validate the relationship between the endPtsOfContours field and the actual available glyph data. When an attacker crafts a font file with an inflated endPtsOfContours value while simultaneously truncating the subsequent glyph data, the parser's internal loop continues reading beyond the legitimate data boundaries. This out-of-bounds memory access manifests as a heap-buffer-overflow condition that can result in arbitrary code execution or application crashes. The vulnerability is particularly concerning because it operates within a fundamental font parsing routine that is invoked during normal font loading operations, making exploitation possible through routine file processing activities.
The operational impact of this vulnerability extends across numerous applications and systems that utilize the stb library for font rendering, including popular game engines like Unity and Unreal Engine, various graphics software packages, and document viewers. Attackers can exploit this weakness by delivering maliciously crafted font files through email attachments, web downloads, or embedded content within documents, potentially leading to remote code execution on vulnerable systems. The vulnerability aligns with CWE-121 heap-based buffer overflow classification and maps to attack techniques in the ATT&CK framework under T1059 command and scripting interpreter and T1203 os commanding through legitimate system processes. Applications that load fonts from untrusted sources are particularly at risk, as the vulnerability can be triggered without user interaction beyond normal font loading procedures.
Mitigation strategies for this vulnerability require immediate action including updating to version 1.27 or later of the stb library where the buffer overflow has been patched. Organizations should implement robust input validation measures that verify font file integrity before processing, and consider deploying sandboxing techniques for font handling operations. Security teams should monitor for exploitation attempts through network traffic analysis and endpoint detection systems, as the vulnerability may be leveraged in targeted attacks against systems running affected software. Additionally, application developers should review their font loading code to ensure proper error handling and bounds checking, while implementing defense-in-depth strategies such as memory corruption detection tools and runtime protections that can identify and prevent exploitation attempts before they succeed.