Bug 2454220 - CVE-2026-5314 stb: Nothings stb: Denial of Service via out-of-bounds read in stb_truetype.h [epel-all]
Summary: CVE-2026-5314 stb: Nothings stb: Denial of Service via out-of-bounds read in ...
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Fedora EPEL
Classification: Fedora
Component: stb
Version: epel10
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
Assignee: Ben Beasley
QA Contact:
URL:
Whiteboard: {"flaws": ["d58717fc-3b56-4efe-ac0c-3...
Depends On:
Blocks: CVE-2026-5314
TreeView+ depends on / blocked
 
Reported: 2026-04-02 06:04 UTC by Sandipan Roy
Modified: 2026-08-27 06:11 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2026-08-27 06:11:19 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Sandipan Roy 2026-04-02 06:04:17 UTC
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Comment 1 Ben Beasley 2026-04-05 14:55:31 UTC
https://www.cve.org/CVERecord?id=CVE-2026-5314

Since this has not been triaged or fixed upstream, and no suggested patch was published, there’s nothing to be done at this time. I’m not planning to try to evaluate the validity of the CVE and devise a downstream patch myself. If a suggested patch appears, I’m happy to evaluate it ahead of upstream if necessary.

Comment 2 Ben Beasley 2026-08-27 06:11:19 UTC
Given that the stb_truetype library begins with the following prominent warning,

// =======================================================================
//
//    NO SECURITY GUARANTEE -- DO NOT USE THIS ON UNTRUSTED FONT FILES
//
// This library does no range checking of the offsets found in the file,
// meaning an attacker can use it to read arbitrary memory.
//
// =======================================================================

it’s certain that upstream would not consider this a valid bug.

For this reason, I’m not interested in trying to develop a patch for this, either.

Given that there’s no patch and probably never will be one, it doesn’t seem useful to track this downstream.

Feel free to reopen this or open a PR if a proposed patch appears, but please understand that stb_truetype is expected to be absolutely riddled with problems like this when used outside of the applications for which it was designed.


Note You need to log in before you can comment on or make changes to this bug.