CVE-2026-5314: medium-severity vulnerability in Nothings stb
Nothings stb TTF File stb_truetype.h stbtt_InitFont_internal out-of-bounds
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 0.7%
A vulnerability was found in Nothings stb up to 1.26. Impacted is the function stbtt_InitFont_internal in the library stb_truetype.h of the component TTF File Handler. Performing a manipulation results in out-of-bounds read. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
Nothings · stbpublic PoCs found — 1
cve_referencegist.github.com/d0razi/cb31a92f3205a4373f19b7da25946848unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Nothings stb
In the same product, most dangerous first.
CVE-2025-3406MEDIUMNothings stb Header Array stbhw_build_tileset_from_image out-of-boundsEPSS 0.6%CVE-2025-3409MEDIUMNothings stb stb_include_string stack-based overflowEPSS 0.5%CVE-2026-5315MEDIUMNothings stb TTF File stb_truetype.h stbtt__buf_get8 out-of-boundsEPSS 0.5%CVE-2025-3408MEDIUMNothings stb stb_dupreplace integer overflowEPSS 0.5%CVE-2025-3407MEDIUMNothings stb stbhw_build_tileset_from_image out-of-boundsEPSS 0.5%CVE-2026-5316MEDIUMNothings stb stb_vorbis.c setup_free allocation of resourcesEPSS 0.4%