CVE-2026-5315: fallo de gravedad media en Nothings stb
Nothings stb TTF File stb_truetype.h stbtt__buf_get8 out-of-bounds
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
33Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 5.3epss 0.5%
A vulnerability was determined in Nothings stb up to 1.26. The affected element is the function stbtt__buf_get8 in the library stb_truetype.h of the component TTF File Handler. Executing a manipulation can lead to out-of-bounds read. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Productos afectados
Nothings · stbPoCs públicas encontradas — 1
cve_referencegist.github.com/d0razi/c11dd07c75f3b795e4f8bbfd6e2f0d29no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Nothings stb
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-5314MEDIUMNothings stb TTF File stb_truetype.h stbtt_InitFont_internal out-of-boundsEPSS 0.7%CVE-2025-3406MEDIUMNothings stb Header Array stbhw_build_tileset_from_image out-of-boundsEPSS 0.6%CVE-2025-3409MEDIUMNothings stb stb_include_string stack-based overflowEPSS 0.5%CVE-2025-3408MEDIUMNothings stb stb_dupreplace integer overflowEPSS 0.5%CVE-2025-3407MEDIUMNothings stb stbhw_build_tileset_from_image out-of-boundsEPSS 0.5%CVE-2026-5316MEDIUMNothings stb stb_vorbis.c setup_free allocation of resourcesEPSS 0.4%