{"id":"CVE-2026-18497","title":"A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files","summary":"A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbtt__GetGlyphShapeTT() function within the nothings stb…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","cwe":["CWE-122"],"published":"2026-08-07","updated":"2026-09-08","sourceUpdated":"2026-09-08T14:07:24.140","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-18497","references":[{"url":"https://cwe.mitre.org/data/definitions/122.html","label":"cret@cert.org"},{"url":"https://github.com/nothings/stb","label":"cret@cert.org"},{"url":"https://github.com/nothings/stb/issues/1905","label":"cret@cert.org"},{"url":"https://kb.cert.org/vuls/id/987105","label":"cret@cert.org"},{"url":"https://www.kb.cert.org/vuls/id/987105","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/nothings/stb/issues/1905","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd"],"epss":0.00194,"epssPercentile":0.08032,"ingestedAt":"2026-09-08T15:33:26.951Z","slug":"CVE-2026-18497","body":"## Overview\n\nA heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbtt__GetGlyphShapeTT() function within the nothings stb_truetype.h library when parsing malformed TTF (TrueType Font) files. The vulnerability resides in the glyph data parsing path.\r\n\r\nAn attacker can craft a malformed TTF file with an inflated endPtsOfContours value and truncate the remaining glyph data. When an application utilizing stb_truetype.h (such as various game engines or graphics software) attempts to load, bake, or render this malformed font via stbtt_GetGlyphShape(), the parser will attempt to read past the end of the glyph data buffer, triggering the out-of-bounds read.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}