CVE-2025-15533: raylib Buffer Overflow Vulnerability

CVE-2025-15533 Overview

A heap-based buffer overflow vulnerability has been discovered in raysan5 raylib up to version 909f040. The vulnerability exists in the GenImageFontAtlas function within the src/rtext.c file. When processing specially crafted font files, the function fails to properly validate the advanceX value retrieved from font data, which can lead to integer overflow conditions or negative memory allocation sizes. This vulnerability can be exploited locally by providing a malicious font file to an application using the affected raylib library.

Critical Impact
Local attackers can trigger a heap-based buffer overflow through malicious font files, potentially leading to application crashes, memory corruption, or arbitrary code execution in applications using vulnerable versions of raylib.

Affected Products

raysan5 raylib versions up to and including commit 909f040
Applications built with vulnerable raylib versions that process untrusted font files
Game development projects and multimedia applications using raylib's font loading functionality

Discovery Timeline

January 18, 2026 - CVE CVE-2025-15533 published to NVD
January 18, 2026 - Last updated in NVD database

Technical Details for CVE-2025-15533

Vulnerability Analysis

The vulnerability resides in raylib's font atlas generation code, specifically within the GenImageFontAtlas function in src/rtext.c. The root issue stems from improper handling of the advanceX metric retrieved from font files via the stb_truetype library's stbtt_GetCodepointHMetrics function.

When processing font glyphs, the code retrieves horizontal advance metrics from the font file without validating whether these values are within safe bounds. Maliciously crafted font files can contain negative advanceX values, which when used in subsequent memory allocation calculations (RL_CALLOC(glyphs[k].advanceX*fontSize, 2)), can cause integer overflow or result in allocations with incorrect sizes.

The exploit has been publicly disclosed through a GitHub PoC Repository, making this vulnerability actively exploitable by attackers with local access to target systems.

Root Cause

The fundamental cause is an input validation failure when processing font metrics from external font files. The advanceX value obtained from stbtt_GetCodepointHMetrics is used directly in memory allocation calculations without bounds checking. Since font files are externally supplied data, they cannot be trusted to contain valid values. A negative advanceX value multiplied by fontSize can overflow, resulting in:

Integer overflow leading to small allocation sizes
Heap buffer overflow when larger amounts of data are written to undersized buffers
Application crashes from invalid memory operations

Attack Vector

This is a local attack vector requiring the attacker to supply a malicious font file to an application built with vulnerable raylib versions. The attack scenario involves:

Attacker crafts a malicious TrueType font file with negative advanceX values
The malicious font file is provided to a target application (e.g., through user-uploaded content, game mods, or local file access)
When the application loads the font using raylib's font loading functions, GenImageFontAtlas processes the malicious metrics
The negative advanceX value causes integer overflow in the RL_CALLOC allocation
Subsequent memory operations overflow the undersized heap buffer

                         stbtt_GetCodepointHMetrics(&fontInfo, cp, &glyphs[k].advanceX, NULL);
                         glyphs[k].advanceX = (int)((float)glyphs[k].advanceX*scaleFactor);
 
+                        // [Security Fix] Prevent integer overflow/negative allocation
+                        // Issue #5436: Malicious font files may contain negative advanceX,
+                        // causing calloc overflow or crash
+                        if (glyphs[k].advanceX < 0) glyphs[k].advanceX = 0;
+
                         Image imSpace = {
-                            .data = RL_CALLOC(glyphs[k].advanceX*fontSize, 2),
+                            // Only allocate memory if width > 0, otherwise set to NULL
+                            .data = (glyphs[k].advanceX > 0) ? RL_CALLOC(glyphs[k].advanceX*fontSize, 2) : NULL,
                             .width = glyphs[k].advanceX,
                             .height = fontSize,
                             .mipmaps = 1,

Source: GitHub Security Patch

Detection Methods for CVE-2025-15533

Indicators of Compromise

Unexpected application crashes when loading font files in raylib-based applications
Heap corruption warnings or memory allocation failures during font processing
Anomalous memory access patterns in applications using GenImageFontAtlas function
Presence of malformed TrueType font files with invalid metric values

Detection Strategies

Implement memory sanitizers (AddressSanitizer, MemorySanitizer) during development and testing to catch heap overflows
Monitor for font file validation failures and unexpected crashes in raylib-based applications
Deploy file integrity monitoring for font directories to detect introduction of malicious font files
Use static analysis tools to identify unsafe uses of font metric values in application code

Monitoring Recommendations

Enable heap corruption detection mechanisms in production environments where feasible
Log and alert on repeated font loading failures from the same source
Implement input validation logging for font file processing operations
Monitor application crash dumps for patterns indicating heap-based buffer overflow exploitation

How to Mitigate CVE-2025-15533

Immediate Actions Required

Update raylib to the latest version containing commit 5a3391fdce046bc5473e52afbd835dd2dc127146 or newer
Rebuild all applications that statically link against vulnerable raylib versions
Restrict font file sources to trusted origins only in affected applications
Implement input validation for font files before passing them to raylib functions

Patch Information

The vulnerability has been fixed in commit 5a3391fdce046bc5473e52afbd835dd2dc127146. The patch adds bounds checking to ensure advanceX values are non-negative before using them in memory allocation calculations. Additionally, the fix includes a conditional allocation that only allocates memory when the width is greater than zero.

Review the fix details at:

Workarounds

Implement font file validation before loading to reject fonts with suspicious or negative metric values
Use application-level sandboxing to contain potential exploitation impact
Restrict font loading to a whitelist of known-good font files in production deployments
Consider using memory-safe wrappers around font loading operations

bash

# Configuration example
# Build raylib from latest source with the security fix
git clone https://github.com/raysan5/raylib.git
cd raylib
git checkout 5a3391fdce046bc5473e52afbd835dd2dc127146
mkdir build && cd build
cmake ..
make
sudo make install