{"document":{"acknowledgments":[{"urls":["https://kb.cert.org/vuls/id/987105#acknowledgements"]}],"category":"CERT/CC Vulnerability Note","csaf_version":"2.0","notes":[{"category":"summary","text":"### Overview\r\nA heap buffer overflow vulnerability exists in the stb TrueType library created by nothings. Exploitation of this vulnerability can occur when handling malformed font data and may lead to both Denial of Service (DoS) and Information Disclosure.\r\n\r\n### Description\r\nThe nothings stb repository, versions 1.26 and earlier, contains a collection of single-file public domain and MIT-licensed libraries for C/C++ projects. \r\n\r\n***CVE-2026-18497*** A heap buffer overflow vulnerability exists in the `stbtt_GetGlyphShape()` function within the `stb_truetype.h` library when handling malformed TrueType Font (TTF) data. The issue occurs during glyph contour parsing. The function iterates based on the number of contour endpoints specified in `endPtsOfContours`, but does not validate that the `points` pointer remains within the bounds of the glyph data buffer. As a result, operations such as `flags = *points++;` may read memory beyond the allocated region. \r\n\r\nAn attacker can exploit this vulnerability by crafting a TTF file that specifies an excessively large `endPtsOfContours` value while providing truncated or minimal glyph data. When an application utilizing `stb_truetype.h` attempts to load, bake, or render this malformed font via `stbtt_GetGlyphShape()`, the parser will continue iterating past the end of the glyph data buffer, triggering the out-of-bounds heap read.\r\n\r\n### Impact\r\nExploitation of this vulnerability can lead to application crashes due to invalid reads of unmapped memory addresses, resulting in denial of service (DoS). In some cases, an attacker may also be able to read data from adjacent heap memory. \r\n\r\n### Solution\r\nUnfortunately, we were unable to reach the stb maintainers to coordinate this vulnerability. Users are advised to monitor the project's GitHub repository for updates and install the latest version of this library once a fix has been released. At the time of this writing, the maintainer of this repository had the following message posted on the project's README page: \"This project discusses security-relevant bugs in public in Github Issues and Pull Requests, and it may take significant time for security fixes to be implemented or merged. If this poses an unreasonable risk to your project, do not use stb libraries.\"\r\n\r\n### Acknowledgements\r\nThank you to Yanzhao Shen for reporting this vulnerability. This document was written by Bob Kemerer.","title":"Summary"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. ","title":"Legal Disclaimer"},{"category":"other","text":"CERT/CC Vulnerability Note is a limited advisory. It primarily identifies vendors impacted by the advisory and not specific products. We only support \"known_affected\" and \"known_not_affected\" status. Please consult the vendor's statements and advisory URL if provided by the vendor for more details ","title":"Limitations of Advisory"}],"publisher":{"category":"coordinator","contact_details":"Email: cert@cert.org, Phone: +1412 268 5800","issuing_authority":"CERT/CC under DHS/CISA https://www.cisa.gov/cybersecurity also see https://kb.cert.org/ ","name":"CERT/CC","namespace":"https://kb.cert.org/"},"references":[{"url":"https://certcc.github.io/certcc_disclosure_policy","summary":"CERT/CC vulnerability disclosure policy"},{"summary":"CERT/CC document released","category":"self","url":"https://kb.cert.org/vuls/id/987105"},{"url":"https://github.com/nothings/stb","summary":"https://github.com/nothings/stb"},{"url":"https://github.com/nothings/stb/issues/1905","summary":"https://github.com/nothings/stb/issues/1905"},{"url":"https://cwe.mitre.org/data/definitions/122.html","summary":"https://cwe.mitre.org/data/definitions/122.html"},{"url":"https://en.wikipedia.org/wiki/Heap_overflow","summary":"https://en.wikipedia.org/wiki/Heap_overflow"}],"title":"The nothings stb TrueType library, up to version 1.26, contains a heap buffer overflow vulnerability","tracking":{"current_release_date":"2026-08-07T14:15:18+00:00","generator":{"engine":{"name":"VINCE","version":"3.0.43"}},"id":"VU#987105","initial_release_date":"2026-08-07 14:15:18.892210+00:00","revision_history":[{"date":"2026-08-07T14:15:18+00:00","number":"1.20260807141518.1","summary":"Released on 2026-08-07T14:15:18+00:00"}],"status":"final","version":"1.20260807141518.1"}},"vulnerabilities":[{"title":"A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.","notes":[{"category":"summary","text":"A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbtt__GetGlyphShapeTT() function within the nothings stb_truetype.h library when parsing malformed TTF (TrueType Font) files. The vulnerability resides in the glyph data parsing path.\r\n\r\nAn attacker can craft a malformed TTF file with an inflated endPtsOfContours value and truncate the remaining glyph data. When an application utilizing stb_truetype.h (such as various game engines or graphics software) attempts to load, bake, or render this malformed font via stbtt_GetGlyphShape(), the parser will attempt to read past the end of the glyph data buffer, triggering the out-of-bounds read."}],"cve":"CVE-2026-18497","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#987105"}]}],"product_tree":{"branches":[]}}