{"vuid":"VU#987105","idnumber":"987105","name":"The nothings stb TrueType library, up to version 1.26, contains a heap buffer overflow vulnerability","keywords":null,"overview":"### Overview\r\nA heap buffer overflow vulnerability exists in the stb TrueType library created by nothings. Exploitation of this vulnerability can occur when handling malformed font data and may lead to both Denial of Service (DoS) and Information Disclosure.\r\n\r\n### Description\r\nThe nothings stb repository, versions 1.26 and earlier, contains a collection of single-file public domain and MIT-licensed libraries for C/C++ projects. \r\n\r\n***CVE-2026-18497*** A heap buffer overflow vulnerability exists in the `stbtt_GetGlyphShape()` function within the `stb_truetype.h` library when handling malformed TrueType Font (TTF) data. The issue occurs during glyph contour parsing. The function iterates based on the number of contour endpoints specified in `endPtsOfContours`, but does not validate that the `points` pointer remains within the bounds of the glyph data buffer. As a result, operations such as `flags = *points++;` may read memory beyond the allocated region. \r\n\r\nAn attacker can exploit this vulnerability by crafting a TTF file that specifies an excessively large `endPtsOfContours` value while providing truncated or minimal glyph data. When an application utilizing `stb_truetype.h` attempts to load, bake, or render this malformed font via `stbtt_GetGlyphShape()`, the parser will continue iterating past the end of the glyph data buffer, triggering the out-of-bounds heap read.\r\n\r\n### Impact\r\nExploitation of this vulnerability can lead to application crashes due to invalid reads of unmapped memory addresses, resulting in denial of service (DoS). In some cases, an attacker may also be able to read data from adjacent heap memory. \r\n\r\n### Solution\r\nUnfortunately, we were unable to reach the stb maintainers to coordinate this vulnerability. Users are advised to monitor the project's GitHub repository for updates and install the latest version of this library once a fix has been released. At the time of this writing, the maintainer of this repository had the following message posted on the project's README page: \"This project discusses security-relevant bugs in public in Github Issues and Pull Requests, and it may take significant time for security fixes to be implemented or merged. If this poses an unreasonable risk to your project, do not use stb libraries.\"\r\n\r\n### Acknowledgements\r\nThank you to Yanzhao Shen for reporting this vulnerability. This document was written by Bob Kemerer.","clean_desc":null,"impact":null,"resolution":null,"workarounds":null,"sysaffected":null,"thanks":null,"author":null,"public":["https://github.com/nothings/stb","https://github.com/nothings/stb/issues/1905","https://cwe.mitre.org/data/definitions/122.html","https://en.wikipedia.org/wiki/Heap_overflow"],"cveids":["CVE-2026-18497"],"certadvisory":null,"uscerttechnicalalert":null,"datecreated":"2026-08-07T14:15:19.022724Z","publicdate":"2026-08-07T14:15:18.892210Z","datefirstpublished":"2026-08-07T14:15:19.038176Z","dateupdated":"2026-08-07T14:15:18.892207Z","revision":1,"vrda_d1_directreport":null,"vrda_d1_population":null,"vrda_d1_impact":null,"cam_widelyknown":null,"cam_exploitation":null,"cam_internetinfrastructure":null,"cam_population":null,"cam_impact":null,"cam_easeofexploitation":null,"cam_attackeraccessrequired":null,"cam_scorecurrent":null,"cam_scorecurrentwidelyknown":null,"cam_scorecurrentwidelyknownexploited":null,"ipprotocol":null,"cvss_accessvector":null,"cvss_accesscomplexity":null,"cvss_authentication":null,"cvss_confidentialityimpact":null,"cvss_integrityimpact":null,"cvss_availabilityimpact":null,"cvss_exploitablity":null,"cvss_remediationlevel":null,"cvss_reportconfidence":null,"cvss_collateraldamagepotential":null,"cvss_targetdistribution":null,"cvss_securityrequirementscr":null,"cvss_securityrequirementsir":null,"cvss_securityrequirementsar":null,"cvss_basescore":null,"cvss_basevector":null,"cvss_temporalscore":null,"cvss_environmentalscore":null,"cvss_environmentalvector":null,"metric":null,"vulnote":232}