PT-2026-89155

An out-of-bounds read in the stbtt GetGlyphShape component of nothings stb commit 31c1ad3 allows attackers to cause a Denial of Service DoS via sending a crafted TTF file...

CVE-2026-18497 The nothings stb TrueType library contains a heap buffer overflow vulnerability

A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbttGetGlyphShapeTT function within the nothings stbtruetype.h library when parsing malformed TTF TrueType Font file...