The nothings stb TrueType library contains a heap buffer overflow vulnerability (CVE-2026-18497) | HOL Guard CVE

High · CVSS 7.1CVE-2026-18497

The nothings stb TrueType library contains a heap buffer overflow vulnerability

Answer in brief

CVE-2026-18497 records a High severity (CVSS 7.1) vulnerability in The nothings stb TrueType library contains a heap buffer overflow vulnerability. The current sources do not mark it as known exploited. The current feed maps Sean Barrett (nothings)/nothings stb (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Aug 7, 2026Updated Sep 8, 2026Source checked Sep 21, 2026First seen by HOL Aug 7, 2026Material review Sep 8, 2026

Upstream Advisory

Key facts

Risk: High · CVSS 7.1
Exploitation: Not marked as known exploited
Affected software: 1 mapped package or product
Fix availability: Not reported

Why this deserves its current priority

CVSS is 7.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Sean Barrett (nothings)/nothings stb (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Sean Barrett (nothings)/nothings stbgeneric	1.26	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Sean Barrett (nothings)/nothings stb.
Review the reported fix. Monitor this advisory for an available fix and review any installs of the affected package.

Evidence timeline and material changes

Published upstream
Aug 7, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 8, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Aug 7, 2026

Sources and claim methodology

Upstream source description

A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbtt__GetGlyphShapeTT() function within the nothings stb_truetype.h library when parsing malformed TTF (TrueType Font) files. The vulnerability resides in the glyph data parsing path. An attacker can craft a malformed TTF file with an inflated endPtsOfContours value and truncate the remaining glyph data. When an application utilizing stb_truetype.h (such as various game engines or graphics software) attempts to load, bake, or render this malformed font via stbtt_GetGlyphShape(), the parser will attempt to read past the end of the glyph data buffer, triggering the out-of-bounds read.

Quoted source text, attributed separately from HOL analysis.