CVE-2026-79515
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The stbtt_GetGlyphShape component in nothings stb (commit 31c1ad3) has an out-of-bounds read that can be exploited via a crafted TTF file, causing a denial of service.
Risk Assessment
An attacker can crash applications processing malicious TTF font files, leading to service unavailability. This requires providing a specially crafted TTF file.
Recommendation
Update the nothings stb library to a patched version or avoid processing untrusted TTF files.
Other vulnerabilities in nothings stb
See all- CVE-2026-79516Medium
The stbsp_vsnprintf function in nothings stb (commit 31c1ad3) has an out-of-bounds read that can be exploited via crafted input, causing a denial of service.
- CVE-2026-5316Medium
A vulnerability was identified in Nothings stb up to 1.22 in the setup_free function of stb_vorbis.c, leading to allocation of resources. The attack can be carried out remotely, and a publicly available exploit might be used. The vendor was contacted early but did not respond.
Original NVD description (English source)
An out-of-bounds read in the stbtt_GetGlyphShape component of nothings stb commit 31c1ad3 allows attackers to cause a Denial of Service (DoS) via sending a crafted TTF file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS