CISA issues update on CVE-2026-18497 in nothings stb TrueType library
2 companies named across 4 categories, one of 72 articles referencing GitHub. Previous coverage: CISA alerts on arbitrary file overwrite in Develar app-builder (Aug 2026).
Companies mentioned
Best suited for
- Seniority
- C Level / Executive Team
- Job function
- Chief Information Security Officer
- Persona
- Security Operations Leader
- Buyer role
- Decision Maker / Budget Holder
- Buyer journey
- Need to Buy
- Adoption curve
- Late Majority
- Technology maturity
- Established Technology
- Industry
- Information Technology / Software & Services / IT Services / Internet Services & Infrastructure
Our classification, not the publisher's statement. Best suited for, not only for.
The nothings stb TrueType library, versions 1.26 and earlier, contains a heap buffer overflow vulnerability in the stbtt_GetGlyphShape() function when handling malformed TrueType Font (TTF) data, with potential outcomes of denial of service (DoS) and information disclosure.
Within the stb_truetype.h library, the vulnerability occurs during glyph contour parsing. The stbtt_GetGlyphShape() function iterates based on the number of contour endpoints specified in endPtsOfContours, but it does not validate that the points pointer remains within the bounds of the glyph data buffer. This lack of validation can allow operations such as flags = *points++; to read memory beyond the allocated region. The issue is identified as CVE-2026-18497. An attacker can craft a TTF file that sets an excessively large endPtsOfContours value while providing truncated or minimal glyph data, and then trigger the out-of-bounds heap read when an application loads, bakes, or renders the font via stbtt_GetGlyphShape().
Exploitation can lead to application crashes due to invalid reads of unmapped memory addresses, resulting in denial of service (DoS). In some cases, exploitation may also allow an attacker to read data from adjacent heap memory.
Coordination with the stb maintainers was not possible for this vulnerability. Users are advised to monitor the project’s GitHub repository for updates and install the latest version of this library once a fix has been released. The README message cited in the advisory states: “This project discusses security-relevant bugs in public in Github Issues and Pull Requests, and it may take significant time for security fixes to be implemented or merged. If this poses an unreasonable risk to your project, do not use stb libraries.”
The advisory credits Yanzhao Shen for reporting the vulnerability. It also states that the document was written by Bob Kemerer.
Blog post, originally published by Bob Kemerer at kb.cert.org.