Software Engineering Institute

Overview

A heap buffer overflow vulnerability exists in the stb TrueType library created by nothings. Exploitation of this vulnerability can occur when handling malformed font data and may lead to both Denial of Service (DoS) and Information Disclosure.

Description

The nothings stb repository, versions 1.26 and earlier, contains a collection of single-file public domain and MIT-licensed libraries for C/C++ projects.

CVE-2026-18497 A heap buffer overflow vulnerability exists in the stbtt_GetGlyphShape() function within the stb_truetype.h library when handling malformed TrueType Font (TTF) data. The issue occurs during glyph contour parsing. The function iterates based on the number of contour endpoints specified in endPtsOfContours, but does not validate that the points pointer remains within the bounds of the glyph data buffer. As a result, operations such as flags = *points++; may read memory beyond the allocated region.

An attacker can exploit this vulnerability by crafting a TTF file that specifies an excessively large endPtsOfContours value while providing truncated or minimal glyph data. When an application utilizing stb_truetype.h attempts to load, bake, or render this malformed font via stbtt_GetGlyphShape(), the parser will continue iterating past the end of the glyph data buffer, triggering the out-of-bounds heap read.

Impact

Exploitation of this vulnerability can lead to application crashes due to invalid reads of unmapped memory addresses, resulting in denial of service (DoS). In some cases, an attacker may also be able to read data from adjacent heap memory.

Solution

Unfortunately, we were unable to reach the stb maintainers to coordinate this vulnerability. Users are advised to monitor the project's GitHub repository for updates and install the latest version of this library once a fix has been released. At the time of this writing, the maintainer of this repository had the following message posted on the project's README page: "This project discusses security-relevant bugs in public in Github Issues and Pull Requests, and it may take significant time for security fixes to be implemented or merged. If this poses an unreasonable risk to your project, do not use stb libraries."

Acknowledgements

Thank you to Yanzhao Shen for reporting this vulnerability. This document was written by Bob Kemerer.

Vendor Information

References

• https://github.com/nothings/stb
• https://github.com/nothings/stb/issues/1905
• https://cwe.mitre.org/data/definitions/122.html
• https://en.wikipedia.org/wiki/Heap_overflow