CVE-2026-18497

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-18497", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2026-07-31T15:58:31.185Z", "datePublished": "2026-08-07T14:19:42.854Z", "dateUpdated": "2026-08-12T13:51:47.080Z"}, "containers": {"cna": {"title": "The nothings stb TrueType library contains a heap buffer overflow vulnerability", "descriptions": [{"lang": "en", "value": "A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbtt__GetGlyphShapeTT() function within the nothings stb_truetype.h library when parsing malformed TTF (TrueType Font) files. The vulnerability resides in the glyph data parsing path.\r\n\r\nAn attacker can craft a malformed TTF file with an inflated endPtsOfContours value and truncate the remaining glyph data. When an application utilizing stb_truetype.h (such as various game engines or graphics software) attempts to load, bake, or render this malformed font via stbtt_GetGlyphShape(), the parser will attempt to read past the end of the glyph data buffer, triggering the out-of-bounds read."}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Sean Barrett (nothings)", "product": "nothings stb", "versions": [{"status": "affected", "version": "1.26"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-122: Heap-based Buffer Overflow"}]}], "references": [{"url": "https://cwe.mitre.org/data/definitions/122.html"}, {"url": "https://github.com/nothings/stb"}, {"url": "https://github.com/nothings/stb/issues/1905"}, {"url": "https://kb.cert.org/vuls/id/987105"}], "x_generator": {"engine": "VINCE 3.0.43", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-18497"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-08-07T14:19:42.854Z"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.kb.cert.org/vuls/id/987105"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-08-07T15:17:50.021Z"}}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-122", "lang": "en", "description": "CWE-122 Heap-based Buffer Overflow"}]}], "references": [{"url": "https://github.com/nothings/stb/issues/1905", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-07T17:58:51.313628Z", "id": "CVE-2026-18497", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T13:51:47.080Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.kb.cert.org/vuls/id/987105"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-08-07T15:17:50.021Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-18497", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-07T17:58:51.313628Z"}}}], "references": [{"url": "https://github.com/nothings/stb/issues/1905", "tags": ["exploit"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T17:58:14.494Z"}}], "cna": {"title": "The nothings stb TrueType library contains a heap buffer overflow vulnerability", "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Sean Barrett (nothings)", "product": "nothings stb", "versions": [{"status": "affected", "version": "1.26"}]}], "references": [{"url": "https://cwe.mitre.org/data/definitions/122.html"}, {"url": "https://github.com/nothings/stb"}, {"url": "https://github.com/nothings/stb/issues/1905"}, {"url": "https://kb.cert.org/vuls/id/987105"}], "x_generator": {"env": "prod", "engine": "VINCE 3.0.43", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-18497"}, "descriptions": [{"lang": "en", "value": "A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbtt__GetGlyphShapeTT() function within the nothings stb_truetype.h library when parsing malformed TTF (TrueType Font) files. The vulnerability resides in the glyph data parsing path.\r\n\r\nAn attacker can craft a malformed TTF file with an inflated endPtsOfContours value and truncate the remaining glyph data. When an application utilizing stb_truetype.h (such as various game engines or graphics software) attempts to load, bake, or render this malformed font via stbtt_GetGlyphShape(), the parser will attempt to read past the end of the glyph data buffer, triggering the out-of-bounds read."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-122: Heap-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-08-07T14:19:42.854Z"}}}, "cveMetadata": {"cveId": "CVE-2026-18497", "state": "PUBLISHED", "dateUpdated": "2026-08-12T13:51:47.080Z", "dateReserved": "2026-07-31T15:58:31.185Z", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "datePublished": "2026-08-07T14:19:42.854Z", "assignerShortName": "certcc"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "nothings stb", "vendor": "Sean Barrett (nothings)", "versions": [{"status": "affected", "version": "1.26"}]}], "source": "cret@cert.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbtt__GetGlyphShapeTT() function within the nothings stb_truetype.h library when parsing malformed TTF (TrueType Font) files. The vulnerability resides in the glyph data parsing path.\r\n\r\nAn attacker can craft a malformed TTF file with an inflated endPtsOfContours value and truncate the remaining glyph data. When an application utilizing stb_truetype.h (such as various game engines or graphics software) attempts to load, bake, or render this malformed font via stbtt_GetGlyphShape(), the parser will attempt to read past the end of the glyph data buffer, triggering the out-of-bounds read."}, {"lang": "es", "value": "Una vulnerabilidad de desbordamiento de b\u00fafer de mont\u00f3n existe en la biblioteca nothings stb TrueType, hasta la versi\u00f3n 1.26, que se utiliza para analizar archivos de fuentes TrueType. La vulnerabilidad existe en la funci\u00f3n stbtt__GetGlyphShapeTT() dentro de la biblioteca nothings stb_truetype.h al analizar archivos TTF (TrueType Font) malformados. La vulnerabilidad reside en la ruta de an\u00e1lisis de datos de glifos.\n\nUn atacante puede crear un archivo TTF malformado con un valor \u2019endPtsOfContours\u2019 inflado y truncar los datos de glifo restantes. Cuando una aplicaci\u00f3n que utiliza stb_truetype.h (como varios motores de juego o software gr\u00e1fico) intenta cargar, generar o renderizar esta fuente malformada a trav\u00e9s de stbtt_GetGlyphShape(), el analizador intentar\u00e1 leer m\u00e1s all\u00e1 del final del b\u00fafer de datos de glifos, lo que activar\u00e1 la lectura fuera de l\u00edmites."}], "id": "CVE-2026-18497", "lastModified": "2026-10-23T21:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18497", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-07T17:58:51.313628Z", "version": "2.0.3"}}]}, "published": "2026-08-07T15:16:59.707", "references": [{"source": "cret@cert.org", "url": "https://cwe.mitre.org/data/definitions/122.html"}, {"source": "cret@cert.org", "url": "https://github.com/nothings/stb"}, {"source": "cret@cert.org", "url": "https://github.com/nothings/stb/issues/1905"}, {"source": "cret@cert.org", "url": "https://kb.cert.org/vuls/id/987105"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.kb.cert.org/vuls/id/987105"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/nothings/stb/issues/1905"}], "sourceIdentifier": "cret@cert.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.26"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "nothings stb", "source": "cna", "vendor": "Sean Barrett (nothings)"}, "product": "nothings_stb", "vendor": "sean_barrett"}], "created": "2026-08-07T15:30:04.874679+00:00", "updated": "2026-08-13T10:45:04.019433+00:00", "vendors": ["sean_barrett", "sean_barrett$PRODUCT$nothings_stb"]}