Vulnerability · Published Aug 7, 2026 · Assigned by certcc
CVE-2026-18497The nothings stb TrueType library contains a heap buffer overflow vulnerability
High 7.1
In plain English
A high-severity heap buffer overflow in nothings stb from Sean Barrett (nothings). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).
Official description
A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbtt__GetGlyphShapeTT() function within the nothings stb_truetype.h library when parsing malformed TTF (TrueType Font) files. The vulnerability resides in the glyph data parsing path. An attacker can craft a malformed TTF file with an inflated endPtsOfContours value and truncate the remaining glyph data. When an application utilizing stb_truetype.h (such as various game engines or graphics software) attempts to load, bake, or render this malformed font via stbtt_GetGlyphShape(), the parser will attempt to read past the end of the glyph data buffer, triggering the out-of-bounds read.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libstb | no fix listed | DEBIAN-CVE-2026-18497 |
| Debian:13 | libstb | no fix listed | DEBIAN-CVE-2026-18497 |
| Debian:14 | libstb | no fix listed | DEBIAN-CVE-2026-18497 |
| Ubuntu:22.04:LTS | libstb | no fix listed | UBUNTU-CVE-2026-18497 |
| Ubuntu:24.04:LTS | libstb | no fix listed | UBUNTU-CVE-2026-18497 |
| Ubuntu:26.04:LTS | libstb | no fix listed | UBUNTU-CVE-2026-18497 |
| Ubuntu:26.10 | libstb | no fix listed | UBUNTU-CVE-2026-18497 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Sean Barrett (nothings) | nothings stb | 1.26 |
Weakness: CWE-122 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H