CISA issues update on CVE-2026-18497 in nothings stb TrueType library

The nothings stb TrueType library, versions 1.26 and earlier, contains a heap buffer overflow vulnerability in the stbtt_GetGlyphShape() function when handling malformed TrueType Font (TTF) data, with potential outcomes of denial of service (DoS) and information disclosure.

Within the stb_truetype.h library, the vulnerability occurs during glyph contour parsing. The stbtt_GetGlyphShape() function iterates based on the number of contour endpoints specified in endPtsOfContours, but it does not validate that the points pointer remains within the bounds of the glyph data buffer. This lack of validation can allow operations such as flags = *points++; to read memory beyond the allocated region. The issue is identified as CVE-2026-18497. An attacker can craft a TTF file that sets an excessively large endPtsOfContours value while providing truncated or minimal glyph data, and then trigger the out-of-bounds heap read when an application loads, bakes, or renders the font via stbtt_GetGlyphShape().

Exploitation can lead to application crashes due to invalid reads of unmapped memory addresses, resulting in denial of service (DoS). In some cases, exploitation may also allow an attacker to read data from adjacent heap memory.

Coordination with the stb maintainers was not possible for this vulnerability. Users are advised to monitor the project’s GitHub repository for updates and install the latest version of this library once a fix has been released. The README message cited in the advisory states: “This project discusses security-relevant bugs in public in Github Issues and Pull Requests, and it may take significant time for security fixes to be implemented or merged. If this poses an unreasonable risk to your project, do not use stb libraries.”

The advisory credits Yanzhao Shen for reporting the vulnerability. It also states that the document was written by Bob Kemerer.