CVE-2026-18497: stb TrueType Buffer Overflow Vulnerability

CVE-2026-18497 Overview

CVE-2026-18497 is a heap-buffer-overflow vulnerability in the nothings stb_truetype.h single-header C library, affecting versions up to 1.26. The flaw resides in the stbtt__GetGlyphShapeTT() function that parses glyph data from TrueType Font (TTF) files. An attacker who crafts a malformed TTF with an inflated endPtsOfContours value and truncated glyph data can trigger an out-of-bounds read when a host application calls stbtt_GetGlyphShape() to load, bake, or render the font. Because stb_truetype.h is embedded in numerous game engines and graphics applications, the vulnerability propagates broadly across consumer software. The issue is tracked as CWE-122: Heap-based Buffer Overflow.

Critical Impact
Local attackers can trigger an out-of-bounds heap read leading to application crash or memory disclosure when a victim opens a malicious TTF file in any application linking stb_truetype.h up to version 1.26.

Affected Products

nothings stb_truetype.h library, versions up to and including 1.26
Applications embedding vulnerable versions of stb_truetype.h (game engines and graphics software)
Downstream distributions of the stb single-file public domain libraries

Discovery Timeline

2026-08-07 - CVE-2026-18497 published to the National Vulnerability Database
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-18497

Vulnerability Analysis

The vulnerability lives in the glyph data parsing path of stbtt__GetGlyphShapeTT(). TrueType glyph descriptions begin with a header that includes numberOfContours and a subsequent endPtsOfContours array. The parser derives the total point count from the maximum value in this array and uses it to iterate through flag bytes and coordinate arrays that follow. When the value is inflated beyond the actual glyph payload, the loop reads memory outside the allocated glyph buffer on the heap. The EPSS score of 0.124% reflects the local attack requirement and the need for user interaction.

Root Cause

The parser trusts the attacker-controlled endPtsOfContours value without validating it against the remaining length of the glyph data buffer. No bounds check confirms that the derived point count fits within the memory region allocated for the glyph. The result is a classic CWE-122 heap-based out-of-bounds read.

Attack Vector

Exploitation requires a user to open or process a malicious TTF file with a vulnerable application. An attacker crafts a TTF containing a glyph whose endPtsOfContours entry points far beyond the truncated glyph payload. When the host application invokes stbtt_GetGlyphShape() during font baking, atlas generation, or rendering, stbtt__GetGlyphShapeTT() walks past the buffer end. The impact spans denial of service through process crash and potential disclosure of adjacent heap contents such as pointers, keys, or user data. Further technical detail is tracked in stb Issue #1905 and CERT VU#987105.

Detection Methods for CVE-2026-18497

Indicators of Compromise

Application crashes or segmentation faults in processes that load TTF assets, correlated with recently opened font files
TTF files where the maximum value in endPtsOfContours exceeds the number of point entries actually present in the glyph table
Heap sanitizer or AddressSanitizer reports pointing to stbtt__GetGlyphShapeTT frames

Detection Strategies

Scan software builds and container images for embedded copies of stb_truetype.h at or below version 1.26 using source-level string matches on the version macro
Fuzz TTF parsing entry points with tools such as libFuzzer or AFL++ against builds compiled with AddressSanitizer to surface out-of-bounds reads
Validate TTF files server-side before distribution to clients by parsing the glyph table and rejecting inconsistent endPtsOfContours values

Monitoring Recommendations

Alert on repeated crashes of applications known to use stb_truetype.h when handling user-supplied fonts
Track outbound and inbound font downloads in build pipelines and asset stores where malicious TTF injection is plausible
Log endpoint process telemetry for graphics applications terminating abnormally after opening files with the .ttf extension

How to Mitigate CVE-2026-18497

Immediate Actions Required

Inventory all applications, engines, and internal tools that vendor stb_truetype.h and identify the embedded version
Restrict loading of untrusted TTF files from email, web downloads, and third-party asset packs until the library is updated
Rebuild downstream applications after upgrading the vendored library and redeploy affected binaries

Patch Information

At publication, no fixed release beyond version 1.26 is referenced in the NVD entry. Monitor the upstream stb GitHub repository and stb Issue #1905 for a patched revision. Because stb_truetype.h is a single-header library, remediation requires each downstream project to update its vendored copy and rebuild.

Workarounds

Add a pre-parse validation step that rejects TTF files where any endPtsOfContours entry is greater than or equal to the remaining glyph buffer length
Sandbox font parsing in a separate low-privilege process so an out-of-bounds read does not disclose sensitive host memory
Disable dynamic loading of user-supplied TTF files in applications that support custom fonts, and ship only vetted fonts

bash

# Identify vendored stb_truetype.h copies and their versions across a source tree
grep -rIn --include='stb_truetype.h' 'STB_TRUETYPE_H_VERSION\|stb_truetype - v' .

# Sandbox a font-processing helper with reduced privileges on Linux
systemd-run --user --scope \
  --property=NoNewPrivileges=yes \
  --property=ProtectSystem=strict \
  --property=ProtectHome=yes \
  --property=PrivateTmp=yes \
  /usr/local/bin/font-parser /path/to/untrusted.ttf