CVE-2026-79515: stb TrueType Parser DoS Vulnerability

CVE-2026-79515 Overview

CVE-2026-79515 is an out-of-bounds read vulnerability in the stbtt_GetGlyphShape component of nothings/stb at commit 31c1ad3. The flaw allows a remote attacker to cause a denial of service (DoS) by supplying a crafted TrueType Font (TTF) file. The stb_truetype.h single-header library is widely embedded in games, rendering engines, and GUI toolkits, which broadens the exposure surface. Exploitation requires user interaction, typically loading or previewing a malicious font file. Successful exploitation results in an application crash rather than code execution or data disclosure.

Critical Impact
Attackers can crash any application that parses untrusted TTF files through the affected stb_truetype.h header, leading to denial of service.

Affected Products

nothings/stb repository at commit 31c1ad3
Applications embedding the vulnerable stb_truetype.h header
Downstream projects that vendor the affected commit

Discovery Timeline

2026-09-09 - CVE-2026-79515 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-79515

Vulnerability Analysis

The vulnerability resides in stbtt_GetGlyphShape, the routine responsible for parsing glyph outline data from a TrueType Font file. When processing a maliciously crafted TTF, the function reads memory outside the bounds of the input buffer. The read operates on attacker-influenced offsets derived from glyph tables, and the parser does not sufficiently validate these offsets against the actual buffer length. This results in an unhandled access that terminates the host process. The impact is limited to availability, with no confidentiality or integrity effects reported.

Root Cause

The root cause is missing bounds validation on glyph table offsets consumed by stbtt_GetGlyphShape. The parser trusts values embedded in the TTF structure without confirming that dereferenced pointers remain within the mapped font buffer. This is a classic out-of-bounds read pattern in binary format parsers.

Attack Vector

Exploitation is network-adjacent and requires user interaction. An attacker delivers a crafted TTF file through a website, email attachment, document, or asset bundle. When the target application invokes stbtt_GetGlyphShape on the malicious font, the process crashes. No authentication is required.

No public proof-of-concept code has been verified. Refer to the GitHub Issue Discussion for technical reproduction details.

Detection Methods for CVE-2026-79515

Indicators of Compromise

Repeated crashes of applications that load font files, particularly during glyph shape extraction.
Crash dumps referencing stbtt_GetGlyphShape or adjacent parsing functions from stb_truetype.h.
Delivery of untrusted .ttf files through email, chat, or web downloads immediately preceding process termination.

Detection Strategies

Enumerate software inventory for products that vendor stb_truetype.h and correlate against commit 31c1ad3.
Monitor endpoint telemetry for repeated abnormal terminations of font-rendering processes.
Perform static scanning of source repositories for embedded copies of the vulnerable header.

Monitoring Recommendations

Alert on TTF files sourced from untrusted origins that are opened by desktop or server applications.
Track application crash events and forward them to a centralized logging pipeline for correlation.
Review build pipelines for third-party dependencies that bundle stb at the affected commit.

How to Mitigate CVE-2026-79515

Immediate Actions Required

Identify all applications and internal projects that include stb_truetype.h from commit 31c1ad3 or earlier.
Restrict processing of TTF files originating from untrusted sources until patched builds are deployed.
Sandbox or isolate font-parsing components to contain crashes and prevent broader service disruption.

Patch Information

No formal vendor patch release is referenced in the current NVD entry. Monitor upstream commits and the GitHub Issue Discussion for a fix, then rebuild dependent binaries against the corrected header.

Workarounds

Validate TTF files with a hardened font parser before passing them to stb_truetype.h.
Enforce file-type and size restrictions on user-supplied font uploads.
Run font-processing workloads in isolated processes with automatic restart to preserve service availability.

bash

# Locate embedded copies of the vulnerable header in source trees
grep -rln "stbtt_GetGlyphShape" /path/to/projects
find /path/to/projects -name "stb_truetype.h" -exec sha256sum {} \;