Nothings stb TTF File stb_truetype.h stbtt__buf_get8 out-of-bounds_CVE-2026-5315

5.3 / 10

MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

Description

A vulnerability was determined in Nothings stb up to 1.26. The affected element is the function stbtt__buf_get8 in the library stb_truetype.h of the component TTF File Handler. Executing a manipulation can lead to out-of-bounds read. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Basic Information

ID CVE-2026-5315

Source VulDB

Published Apr 1, 2026 at 23:15

Modified Apr 2, 2026 at 13:32

Affected Product

Vendor Nothings

Product stb

Version 1.0

Affected Versions Nothings stb 1.0
Nothings stb 1.1
Nothings stb 1.2
Nothings stb 1.3
Nothings stb 1.4
Nothings stb 1.5
Nothings stb 1.6
Nothings stb 1.7
Nothings stb 1.8
Nothings stb 1.9
Nothings stb 1.10
Nothings stb 1.11
Nothings stb 1.12
Nothings stb 1.13
Nothings stb 1.14
Nothings stb 1.15
Nothings stb 1.16
Nothings stb 1.17
Nothings stb 1.18
Nothings stb 1.19
Nothings stb 1.20
Nothings stb 1.21
Nothings stb 1.22
Nothings stb 1.23
Nothings stb 1.24
Nothings stb 1.25
Nothings stb 1.26

CWE Classification

CWE-125 CWE-119

References

{
    "lastseen": "",
    "description": "A vulnerability was determined in Nothings stb up to 1.26. The affected element is the function stbtt__buf_get8 in the library stb_truetype.h of the component TTF File Handler. Executing a manipulation can lead to out-of-bounds read. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.",
    "published": "2026-04-01T23:15:12.505Z",
    "modified": "2026-04-02T13:32:19.636Z",
    "type": "cve",
    "title": "Nothings stb TTF File stb_truetype.h stbtt__buf_get8 out-of-bounds",
    "source": "VulDB",
    "references": "https://vuldb.com/vuln/354647\nhttps://vuldb.com/vuln/354647/cti\nhttps://vuldb.com/submit/780559\nhttps://gist.github.com/d0razi/c11dd07c75f3b795e4f8bbfd6e2f0d29",
    "id": "CVE-2026-5315",
    "bulletinFamily": "",
    "cwe": [
        "CWE-125",
        "CWE-119"
    ],
    "cvelist": null,
    "sourceData": "Nothings stb 1.0\nNothings stb 1.1\nNothings stb 1.2\nNothings stb 1.3\nNothings stb 1.4\nNothings stb 1.5\nNothings stb 1.6\nNothings stb 1.7\nNothings stb 1.8\nNothings stb 1.9\nNothings stb 1.10\nNothings stb 1.11\nNothings stb 1.12\nNothings stb 1.13\nNothings stb 1.14\nNothings stb 1.15\nNothings stb 1.16\nNothings stb 1.17\nNothings stb 1.18\nNothings stb 1.19\nNothings stb 1.20\nNothings stb 1.21\nNothings stb 1.22\nNothings stb 1.23\nNothings stb 1.24\nNothings stb 1.25\nNothings stb 1.26",
    "sourceHref": "",
    "cvss": {
        "score": 5.3,
        "severity": "MEDIUM",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "stb",
    "version": "1.0",
    "vendor": "Nothings",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}