---
id: CVE-2026-18497
title: >-
  A heap-buffer-overflow vulnerability exists in the nothings stb TrueType
  library, up to version 1.26, that is used for parsing TrueType font files
summary: >-
  A heap-buffer-overflow vulnerability exists in the nothings stb TrueType
  library, up to version 1.26, that is used for parsing TrueType font files. The
  vulnerability exists in the stbtt__GetGlyphShapeTT() function within the
  nothings stb…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H'
cwe:
  - CWE-122
published: '2026-08-07'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T14:07:24.140'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-18497'
references:
  - url: 'https://cwe.mitre.org/data/definitions/122.html'
    label: cret@cert.org
  - url: 'https://github.com/nothings/stb'
    label: cret@cert.org
  - url: 'https://github.com/nothings/stb/issues/1905'
    label: cret@cert.org
  - url: 'https://kb.cert.org/vuls/id/987105'
    label: cret@cert.org
  - url: 'https://www.kb.cert.org/vuls/id/987105'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://github.com/nothings/stb/issues/1905'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00194
epssPercentile: 0.0798
ingestedAt: '2026-09-08T15:33:26.951Z'
---

## Overview

A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbtt__GetGlyphShapeTT() function within the nothings stb_truetype.h library when parsing malformed TTF (TrueType Font) files. The vulnerability resides in the glyph data parsing path.

An attacker can craft a malformed TTF file with an inflated endPtsOfContours value and truncate the remaining glyph data. When an application utilizing stb_truetype.h (such as various game engines or graphics software) attempts to load, bake, or render this malformed font via stbtt_GetGlyphShape(), the parser will attempt to read past the end of the glyph data buffer, triggering the out-of-bounds read.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.