Vulnerability · Published Jan 18, 2026 · Assigned by VulDB

CVE-2025-15533raysan5 raylib rtext.c GenImageFontAtlas heap-based overflow

Medium 5.3

In plain English

A medium-severity heap buffer overflow in raylib from raysan5. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 73.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in raysan5 raylib up to 909f040. Affected by this vulnerability is the function GenImageFontAtlas of the file src/rtext.c. Executing a manipulation can lead to heap-based buffer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. This patch is called 5a3391fdce046bc5473e52afbd835dd2dc127146. Applying a patch is advised to resolve this issue.

Affected products (as reported)

Vendor	Product	Versions
raysan5	raylib	909f040

Weakness: CWE-122, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References

VDB-341705 | raysan5 raylib rtext.c GenImageFontAtlas heap-based overflow vdb-entry, technical-description
VDB-341705 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #733341 | raysan5 raylib 909f040 Heap-based Buffer Overflow third-party-advisory
Submit #733342 | raysan5 raylib 909f040 Heap-based Buffer Overflow (Duplicate) third-party-advisory
https://github.com/raysan5/raylib/issues/5433 issue-tracking
https://github.com/raysan5/raylib/pull/5450 issue-tracking
https://github.com/oneafter/1224/blob/main/hbf2 exploit
https://github.com/raysan5/raylib/commit/5a3391fdce046bc5473e52afbd835dd2dc127146 patch
https://github.com/raysan5/raylib/ product