# Heap overflow found in stb_truetype library

Published: 2026-08-07 · Severity: routine
Canonical: https://vorant.io/reports/609601b0-e8c9-5b60-a842-a6c7fc0552d8/heap-overflow-found-in-stb-truetype-library

> A heap buffer overflow in stb_truetype.h's font parser can be triggered by malformed TTF files, causing crashes or memory disclosure, with no vendor patch available.

CERT/CC disclosed a heap buffer overflow vulnerability (CVE-2026-18497) in the widely-used stb_truetype.h single-header library, part of the popular nothings/stb collection embedded in countless C/C++ projects. The flaw resides in stbtt_GetGlyphShape(), which parses TrueType glyph contour data without validating that the points pointer stays within the bounds of the glyph data buffer. A crafted TTF file with an inflated endPtsOfContours value paired with truncated glyph data can cause the parser to read past the allocated heap region.

Applications that load, bake, or render untrusted fonts using this library are at risk of crashing (denial of service) or leaking adjacent heap memory contents to an attacker who can control or observe the parsing output. Because stb_truetype.h is embedded directly into source trees rather than distributed as a versioned dependency, exposure is likely widespread but difficult to inventory.

CERT/CC was unable to coordinate disclosure with the stb maintainer, who has stated a preference for public, unhurried security discussion via GitHub issues and explicitly advises against use of stb libraries by projects that cannot tolerate this risk posture. No patch is currently available; affected projects should monitor the upstream repository and consider mitigations such as font validation, sandboxing, or memory-safety tooling (e.g., ASan) in the interim.

## Mentioned in this report

- Vulnerabilities: CVE-2026-18497

Source reporting: https://kb.cert.org/vuls/id/987105

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/609601b0-e8c9-5b60-a842-a6c7fc0552d8/heap-overflow-found-in-stb-truetype-library.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup