CVE-2026-18497

{
  "id": "CVE-2026-18497",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-07T15:16:59.707",
  "lastModified": "2026-10-23T21:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbtt__GetGlyphShapeTT() function within the nothings stb_truetype.h library when parsing malformed TTF (TrueType Font) files. The vulnerability resides in the glyph data parsing path.\r\n\r\nAn attacker can craft a malformed TTF file with an inflated endPtsOfContours value and truncate the remaining glyph data. When an application utilizing stb_truetype.h (such as various game engines or graphics software) attempts to load, bake, or render this malformed font via stbtt_GetGlyphShape(), the parser will attempt to read past the end of the glyph data buffer, triggering the out-of-bounds read."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de desbordamiento de búfer de montón existe en la biblioteca nothings stb TrueType, hasta la versión 1.26, que se utiliza para analizar archivos de fuentes TrueType. La vulnerabilidad existe en la función stbtt__GetGlyphShapeTT() dentro de la biblioteca nothings stb_truetype.h al analizar archivos TTF (TrueType Font) malformados. La vulnerabilidad reside en la ruta de análisis de datos de glifos.\n\nUn atacante puede crear un archivo TTF malformado con un valor ’endPtsOfContours’ inflado y truncar los datos de glifo restantes. Cuando una aplicación que utiliza stb_truetype.h (como varios motores de juego o software gráfico) intenta cargar, generar o renderizar esta fuente malformada a través de stbtt_GetGlyphShape(), el analizador intentará leer más allá del final del búfer de datos de glifos, lo que activará la lectura fuera de límites."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Sean Barrett (nothings)",
          "product": "nothings stb",
          "versions": [
            {
              "version": "1.26",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-07T17:58:51.313628Z",
          "id": "CVE-2026-18497",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-122"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cwe.mitre.org/data/definitions/122.html",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/nothings/stb",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/nothings/stb/issues/1905",
      "source": "[email protected]"
    },
    {
      "url": "https://kb.cert.org/vuls/id/987105",
      "source": "[email protected]"
    },
    {
      "url": "https://www.kb.cert.org/vuls/id/987105",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/nothings/stb/issues/1905",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}