CVE-2026-5315CWE-119CWE-125

Nothings stb TTF File stb_truetype.h stbtt__buf_get8 out-of-bounds

Medium · published April 1, 2026

CVSS v4.0
5.3
EPSS
1%
Percentile
57.7
In the wild
Unconfirmed
What it is

A vulnerability was determined in Nothings stb up to 1.26. The affected element is the function stbtt__buf_get8 in the library stb_truetype.h of the component TTF File Handler. Executing a manipulation can lead to out-of-bounds read. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00847 · 57.7th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-125 · Out-of-bounds Read
Published
2026-04-01T23:15Z
EPSS history
Timeline
  • 01 APR 23:15Z
    Nothings stb TTF File stb_truetype.h stbtt__buf_get8 out-of-bounds
    cvelistv5