VulnSocial

CVE-2026-18497Patch

LOWCVSS 7.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbtt__GetGlyphShapeTT() function within the nothings stb_truetype.h library when parsing malformed TTF (TrueType Font) files. The vulnerability resides in the glyph data parsing path. An attacker can craft a malformed TTF file with an inflated endPtsOfContours value and truncate the remaining glyph data. When an application utilizing stb_truetype.h (such as various game engines or graphics software) attempts to load, bake, or render this malformed font via stbtt_GetGlyphShape(), the parser will attempt to read past the end of the glyph data buffer, triggering the out-of-bounds read.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-122

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-08-07: 1Patch / Workaround · 2026-08-07: 1Technical Details · 2026-08-07: 108-07
Signal classification1 categories
Patch
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • OJOBIT@0J0BIT
    Patch

    versions 1.26 and earlier of nothings' stb repository ship this flaw in stbtruetype.h, a single-file C/C++ library for rasterizing TrueType fonts > CVE-2026-18497 hits stbtruetype.h up to 1.26: stbttGetGlyphShape() reads past glyph buffer bounds on crafted TTF, enabling crashes and heap data disclosure > stbtruetype.h through 1.26 has a heap buffer overflow in stbttGetGlyphShape() when parsing malformed TrueType glyph contours > CVE-2026-18497 hits stbtruetype.h through version 1.26 with a heap buffer overflow in stbttGetGlyphShape(), and a crafted TrueType font can walk the parser past its > this is a textbook CWE-122 heap overflow, but the out-of-bounds access is a read, not a write > Yanzhao Shen reported the vulnerability, and CERT/CC published the advisory on 2026-08-07 > until upstream merges a patch, treat any font input passed to stbtruetype.h as untrusted, pin your dependency to a known-good commit, and consider fuzzing or https://news.ojobit.com/story/cve-2026-18497-stb-truetype-heap-overflow-bd68d8

    Post summary

    The notice highlights CVE‑2026‑18497, a heap buffer overflow in stbtruetype.h, and recommends treating fonts as untrusted, pinning the dependency to a safe commit, and waiting for an upstream patch.

    0000049
    12 followersView on X

Explore more

Back to dashboard