Heap overflow found in stb_truetype library
A heap buffer overflow in stb_truetype.h's font parser can be triggered by malformed TTF files, causing crashes or memory disclosure, with no vendor patch available.
Sourcekb.cert.org — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT/CC disclosed a heap buffer overflow vulnerability (CVE-2026-18497) in the widely-used stb_truetype.h single-header library, part of the popular nothings/stb collection embedded in countless C/C++ projects. The flaw resides in stbtt_GetGlyphShape(), which parses TrueType glyph contour data without validating that the points pointer stays within the bounds of the glyph data buffer. A crafted TTF file with an inflated endPtsOfContours value paired with truncated glyph data can cause the parser to read past the allocated heap region.
Applications that load, bake, or render untrusted fonts using this library are at risk of crashing (denial of service) or leaking adjacent heap memory contents to an attacker who can control or observe the parsing output. Because stb_truetype.h is embedded directly into source trees rather than distributed as a versioned dependency, exposure is likely widespread but difficult to inventory.
CERT/CC was unable to coordinate disclosure with the stb maintainer, who has stated a preference for public, unhurried security discussion via GitHub issues and explicitly advises against use of stb libraries by projects that cannot tolerate this risk posture. No patch is currently available; affected projects should monitor the upstream repository and consider mitigations such as font validation, sandboxing, or memory-safety tooling (e.g., ASan) in the interim.
Mentioned in this report
Source reporting: https://kb.cert.org/vuls/id/987105
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs