Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
https://www.cve.org/CVERecord?id=CVE-2026-5314 Since this has not been triaged or fixed upstream, and no suggested patch was published, there’s nothing to be done at this time. I’m not planning to try to evaluate the validity of the CVE and devise a downstream patch myself. If a suggested patch appears, I’m happy to evaluate it ahead of upstream if necessary.
Given that the stb_truetype library begins with the following prominent warning, // ======================================================================= // // NO SECURITY GUARANTEE -- DO NOT USE THIS ON UNTRUSTED FONT FILES // // This library does no range checking of the offsets found in the file, // meaning an attacker can use it to read arbitrary memory. // // ======================================================================= it’s certain that upstream would not consider this a valid bug. For this reason, I’m not interested in trying to develop a patch for this, either. Given that there’s no patch and probably never will be one, it doesn’t seem useful to track this downstream. Feel free to reopen this or open a PR if a proposed patch appears, but please understand that stb_truetype is expected to be absolutely riddled with problems like this when used outside of the applications for which it was designed.