CVE-2026-5314: Nothings stb TTF File stb_truetype.h stbtt_InitFont_internal out-of-bounds
A vulnerability was found in Nothings stb up to 1.26. Impacted is the function stbttInitFontinternal in the library stbtruetype.h of the component TTF File Handler. Performing a manipulation results in out-of-bounds read. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5314?
CVE-2026-5314 is classified as a medium-severity vulnerability due to the potential for out-of-bounds read operations.
How do I fix CVE-2026-5314?
To mitigate CVE-2026-5314, upgrade the Nothings stb library to version 1.27 or later.
What type of vulnerability is CVE-2026-5314?
CVE-2026-5314 is an out-of-bounds read vulnerability in the TTF File Handler component of the Nothings stb library.
What versions of Nothings stb are affected by CVE-2026-5314?
CVE-2026-5314 affects all versions of Nothings stb up to and including version 1.26.
What component is impacted by CVE-2026-5314?
CVE-2026-5314 impacts the stbtt_InitFont_internal function within the stb_truetype.h file of the Nothings stb library.