VendorsNothingsstb_truetype.hall versions
Vulnerabilities

Nothings stb truetype.h

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

12CVEs
CVE-2020-6623
stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_get_index.
Published 2020-01-08 · Modified
8.8EPSS 0.015
CVE-2020-6622
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_peek8.
Published 2020-01-08 · Modified
8.8EPSS 0.014
CVE-2020-6620
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_get8.
Published 2020-01-08 · Modified
8.8EPSS 0.011
CVE-2020-6621
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in ttUSHORT.
Published 2020-01-08 · Modified
8.8EPSS 0.011
CVE-2020-6617
stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_int.
Published 2020-01-08 · Modified
8.8EPSS 0.011
CVE-2020-6618
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__find_table.
Published 2020-01-08 · Modified
8.8EPSS 0.011
CVE-2020-6619
stb stb_truetype.h through 1.22 has an assertion failure in stbtt__buf_seek.
Published 2020-01-08 · Modified
8.8EPSS 0.011
CVE-2026-5314
Nothings stb TTF File stb_truetype.h stbtt_InitFont_internal out-of-bounds
Published 2026-04-01 · Analyzed
8.8EPSS 0.008
CVE-2026-5315
Nothings stb TTF File stb_truetype.h stbtt__buf_get8 out-of-bounds
Published 2026-04-01 · Analyzed
8.8EPSS 0.008
CVE-2022-25514
stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttUSHORT() at stb_truetype.h. NOTE: Third party has disputed stating that the source code has also a disclaimer that it should only be used with trusted input.
Published 2022-03-17 · Modified
7.5EPSS 0.010
CVE-2022-25515
stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttULONG() at stb_truetype.h. NOTE: Third party has disputed stating that the source code has also a disclaimer that it should only be used with trusted input.
Published 2022-03-17 · Modified
6.5EPSS 0.009
CVE-2022-25516
stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function stbtt__find_table at stb_truetype.h. NOTE: Third party has disputed stating that the source code has also a disclaimer that it should only be used with trusted input.
Published 2022-03-17 · Modified
6.5EPSS 0.009