Bug 2521844 - CVE-2026-18497 stb: nothings stb TrueType library: Heap Buffer Overflow via malformed TrueType Font files [fedora-all]
Summary: CVE-2026-18497 stb: nothings stb TrueType library: Heap Buffer Overflow via m...
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Fedora
Classification: Fedora
Component: stb
Version: rawhide
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
Assignee: Ben Beasley
QA Contact:
URL:
Whiteboard: {"flaws": ["cf81c879-dcda-47cb-9455-b...
Depends On:
Blocks: CVE-2026-18497 2521845
TreeView+ depends on / blocked
 
Reported: 2026-08-24 12:42 UTC by Vladimir Vasilev
Modified: 2026-08-27 13:43 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2026-08-24 15:48:28 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Vladimir Vasilev 2026-08-24 12:42:23 UTC
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbtt__GetGlyphShapeTT() function within the nothings stb_truetype.h library when parsing malformed TTF (TrueType Font) files. The vulnerability resides in the glyph data parsing path.

An attacker can craft a malformed TTF file with an inflated endPtsOfContours value and truncate the remaining glyph data. When an application utilizing stb_truetype.h (such as various game engines or graphics software) attempts to load, bake, or render this malformed font via stbtt_GetGlyphShape(), the parser will attempt to read past the end of the glyph data buffer, triggering the out-of-bounds read.

Comment 1 Ben Beasley 2026-08-24 15:48:28 UTC
Neither the CVE https://www.cve.org/CVERecord?id=CVE-2026-18497 nor the linked upstream issue https://github.com/nothings/stb/issues/1905 includes a patch.

Given that the stb_truetype library begins with the following prominent warning,

// =======================================================================
//
//    NO SECURITY GUARANTEE -- DO NOT USE THIS ON UNTRUSTED FONT FILES
//
// This library does no range checking of the offsets found in the file,
// meaning an attacker can use it to read arbitrary memory.
//
// =======================================================================

it’s certain that upstream would not consider this a valid bug.

For those reasons, I’m not interested in trying to develop a patch for this, either.

Given that there’s no patch and probably never will be one, it doesn’t seem useful to track this downstream.

Feel free to reopen this or open a PR if a proposed patch appears, but please understand that stb_truetype is expected to be absolutely riddled with problems like this when used outside of the applications for which it was designed.


Note You need to log in before you can comment on or make changes to this bug.