CVE-2026-5315
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
A vulnerability was found in the stb library (stb_truetype.h) up to version 1.26, in the stbtt__buf_get8 function handling TTF files. Manipulation can lead to an out-of-bounds read. The attack can be executed remotely and the exploit has been publicly disclosed.
Risk Assessment
A remote attacker could trigger an out-of-bounds read, potentially causing data leakage or application crash when processing untrusted TTF files. Public exploit availability increases the risk of exploitation.
Recommendation
Update the stb library to a patched version or validate TTF files before processing as a mitigation. Monitor applications using stb_truetype for font rendering.
Other vulnerabilities in stb
See all- CVE-2026-102805Medium
A flaw was found in Nothings stb up to version 1.16 affecting the stbi_write_png_to_mem, stbi_write_jpg_core, and stbi_write_tga_core functions (stb_image_write.h) in the Image Encoding component. Manipulation leads to an integer overflow. The attack can be executed remotely, and the exploit is publicly available.
- CVE-2026-102804Medium
A vulnerability was detected in Nothings stb up to version 2c980bb59875b0d32144a71867fbdebb2f77cd20 affecting the hexwave_init function (stb_hexwave.h). Manipulation of the width/oversample arguments results in an integer overflow. Remote exploitation is possible, and the exploit is now public.
- CVE-2026-5317Medium
A security flaw has been discovered in Nothings stb up to 1.22, affecting the start_decoder function in stb_vorbis.c. The manipulation results in an out-of-bounds write. The exploit has been released to the public and may be used for remote attacks.
- CVE-2026-5314Medium
A vulnerability in the stb library (stb_truetype.h) up to version 1.26 causes an out-of-bounds read in stbtt_InitFont_internal when processing TTF files. The flaw can be exploited remotely and a public exploit exists.
- CVE-2026-5313Medium
In the stb library (stb_image.h) up to version 2.30, the stbi__gif_load_next function in the GIF decoder component allows denial of service via crafted input. The vulnerability can be exploited remotely and the exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability was determined in Nothings stb up to 1.26. The affected element is the function stbtt__buf_get8 in the library stb_truetype.h of the component TTF File Handler. Executing a manipulation can lead to out-of-bounds read. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS