Description

An out-of-bounds read in the stbtt_GetGlyphShape component of nothings stb commit 31c1ad3 allows attackers to cause a Denial of Service (DoS) via sending a crafted TTF file.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-09T21:17:04.400Z",
  "pubdate": "2026-09-09T21:17:04.400Z",
  "executiveSummary": "An out-of-bounds (OOB) read vulnerability exists in the stbtt_GetGlyphShape component of the nothings/stb library, specifically identified at commit 31c1ad3.\nThis vulnerability is triggered when the library processes a maliciously crafted TrueType Font (TTF) file.\nThe primary impact of this flaw is a Denial of Service (DoS), as the out-of-bounds memory access typically leads to application crashes or undefined behavior.\nThe vulnerability affects systems utilizing the stb_truetype.h implementation within the specified commit range.\nAttackers can exploit this issue by providing a malformed TTF file to any application that uses the vulnerable function to parse font data.\nNo authentication or elevated privileges are required to initiate this attack, provided the attacker can influence the input file processed by the target application.\nThe risk is primarily availability-related, posing a threat to applications that rely on external, untrusted font files for rendering or processing.",
  "technicalDetails": "The vulnerability resides within the stbtt_GetGlyphShape function, which is responsible for parsing the glyph outline data within a TTF file. The root cause of the vulnerability is an insufficient validation of offsets and length indices extracted from the font file's tables during the glyph shape extraction process.\nWhen a specially crafted TTF file is provided, the function fails to verify that the calculated memory access indices remain within the bounds of the allocated buffer containing the font data. Consequently, the function attempts to read memory outside the authorized data structures.\nThe exploitation flow begins when the host application calls stbtt_GetGlyphShape to interpret font glyphs. The attacker embeds a malicious structure in the TTF file that defines a glyph offset or vertex count that deviates from standard specifications, specifically targeting the logic used to navigate the glyph data stream. As the parser iterates through the font instructions, it uses these tainted indices to read coordinates or curve points from the input buffer. Because the bounds checks are either missing or bypassed, the pointer arithmetic evaluates to a memory address outside the expected range.\nDepending on the memory layout and the specific runtime environment, this out-of-bounds read may cause the process to access unmapped memory, resulting in a segmentation fault and subsequent process termination. In some scenarios, this can also lead to an information disclosure if the application continues execution and processes or returns the out-of-bounds memory content. The vulnerability is triggered as soon as the library attempts to interpret the malformed glyph structure, requiring no specific user interaction beyond opening or parsing the malicious file.\nThis flaw is inherent to the logic of the C-based parser in commit 31c1ad3 of the stb library. It persists until input sanitization is strictly enforced during the table-parsing phase, ensuring that all vertex data pointers are validated against the actual extent of the input byte array before any dereferencing occurs."
}