CVE-2026-5315
Description
A flaw was found in Nothings stb. A remote attacker could exploit a vulnerability in the stbtt__buf_get8 function of the stb_truetype.h library by manipulating input. This could lead to an out-of-bounds read, potentially causing a denial of service (DoS) for affected systems.
Statement
This Moderate impact vulnerability in Nothings stb, specifically within the stb_truetype.h library's TTF file handling, could allow a remote attacker to trigger an out-of-bounds read. By manipulating input, an attacker could cause a denial of service on systems processing malicious TrueType Font files. This affects Red Hat Community Projects, including packages distributed via EPEL.
Mitigation
To mitigate this issue, avoid processing untrusted TrueType font files with applications that utilize the Nothings stb library. Restrict the sources of font files to trusted origins to prevent potential denial of service attacks.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
