CVE-2022-25514: High severity nothings stb true type vulnerability

Published Mar 17, 2022

Updated

DISPUTED stbtruetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttUSHORT() at stbtruetype.h. NOTE: Third party has disputed stating that the source code has also a disclaimer that it should only be used with trusted input.

Affected Software

1 affected component

Nothings Stb Truetype.h=1.26

Event History

Mar 17, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Disputed

01:15 AM

Data Sourced

via NVD·01:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the vulnerability ID?

The vulnerability ID is CVE-2022-25514.

What is the severity of CVE-2022-25514?

The severity of CVE-2022-25514 is high with a score of 7.5.

What software is affected by CVE-2022-25514?

The software affected by CVE-2022-25514 is stb_truetype.h version 1.26.

What is the description of CVE-2022-25514?

CVE-2022-25514 is a heap-buffer-overflow vulnerability in stb_truetype.h version 1.26, specifically in the ttUSHORT() function.

Is CVE-2022-25514 disputed?

Yes, CVE-2022-25514 is disputed, with a third party claiming that the source code includes a disclaimer to only use it with trusted input.

Are there any references related to CVE-2022-25514?

Yes, you can find more information about CVE-2022-25514 at the following link: [https://github.com/nothings/stb/issues/1286](https://github.com/nothings/stb/issues/1286)

What is the CWE ID for CVE-2022-25514?

The CWE ID for CVE-2022-25514 is 787.