Nothings Stb Truetype.H vulnerabilities
12 vulnerabilities
Known vulnerabilities in Nothings Stb Truetype.H, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2020-6621ubuntulibstb+1
EPSS score1.14%
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in ttUSHORT.CVE-2020-6618ubuntulibstb+1EPSS score1.14%
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__find_table.CVE-2020-6622ubuntulibstb+1EPSS score1.45%
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_peek8.CVE-2020-6619ubuntulibstb+1EPSS score1.14%
stb stb_truetype.h through 1.22 has an assertion failure in stbtt__buf_seek.CVE-2020-6623ubuntulibstb+1EPSS score1.45%
stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_get_index.CVE-2020-6620ubuntulibstb+1EPSS score1.14%
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_get8.CVE-2020-6617ubuntulibstb+1EPSS score1.14%
stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_int.CVE-2022-25516nothingsstb_truetype.hEPSS score0.94%
stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function stbtt__find_table at stb_truetype.h. NOTE: Third party has disputed stating that the source code has also a disclaimer that it should only be used with trusted input.CVE-2022-25514nothingsstb_truetype.hEPSS score1.04%
stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttUSHORT() at stb_truetype.h. NOTE: Third party has disputed stating that the source code has also a disclaimer that it should only be used with trusted input.CVE-2022-25515nothingsstb_truetype.hEPSS score0.94%
stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttULONG() at stb_truetype.h. NOTE: Third party has disputed stating that the source code has also a disclaimer that it should only be used with trusted input.CVE-2026-5314debianlibstb+3EPSS score0.85%
A vulnerability was found in Nothings stb up to 1.26. Impacted is the function stbtt_InitFont_internal in the library stb_truetype.h of the component TTF File Handler. Performing a manipulation results in out-of-bounds read. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.CVE-2026-5315debianlibstb+3EPSS score0.85%
A vulnerability was determined in Nothings stb up to 1.26. The affected element is the function stbtt__buf_get8 in the library stb_truetype.h of the component TTF File Handler. Executing a manipulation can lead to out-of-bounds read. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.