Bug 2454218

Summary:	CVE-2026-5315 stb: Nothings stb: Denial of Service via out-of-bounds read in TTF file handling [epel-all]
Product:	[Fedora] Fedora EPEL	Reporter:	Sandipan Roy <saroy>
Component:	stb	Assignee:	Ben Beasley <code>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	epel10	CC:	code, mhroncok
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["9c99e835-abf4-463d-849e-c2691b09f60d"]}
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-08-27 06:11:07 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2454167

Description Sandipan Roy 2026-04-02 06:03:49 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Comment 1 Ben Beasley 2026-04-05 14:57:16 UTC

https://www.cve.org/CVERecord?id=CVE-2026-5315

Since this has not been triaged or fixed upstream, and no suggested patch was published, there’s nothing to be done at this time. I’m not planning to try to evaluate the validity of the CVE and devise a downstream patch myself. If a suggested patch appears, I’m happy to evaluate it ahead of upstream if necessary.

Comment 2 Ben Beasley 2026-08-27 06:11:07 UTC

Given that the stb_truetype library begins with the following prominent warning,

// =======================================================================
//
//    NO SECURITY GUARANTEE -- DO NOT USE THIS ON UNTRUSTED FONT FILES
//
// This library does no range checking of the offsets found in the file,
// meaning an attacker can use it to read arbitrary memory.
//
// =======================================================================

it’s certain that upstream would not consider this a valid bug.

For this reason, I’m not interested in trying to develop a patch for this, either.

Given that there’s no patch and probably never will be one, it doesn’t seem useful to track this downstream.

Feel free to reopen this or open a PR if a proposed patch appears, but please understand that stb_truetype is expected to be absolutely riddled with problems like this when used outside of the applications for which it was designed.