CVE-2026-18497

Name of the Vulnerable Software and Affected Versions nothings stb TrueType library versions prior to 1.27

Description A heap-buffer-overflow occurs when parsing malformed TrueType Font (TTF) files. The issue is located in the glyph data parsing path within the stbtt GetGlyphShapeTT() function of the stb truetype.h library. An attacker can trigger an out-of-bounds read by crafting a TTF file with an inflated endPtsOfContours value and truncating the remaining glyph data. This occurs when an application using the library attempts to load, bake, or render the font via stbtt GetGlyphShape().

Recommendations Update to a version later than 1.26. As a temporary workaround, restrict the loading of untrusted or malformed TTF files until the library is updated.