PT-2026-29652 · Stb · Stb

D0Razi + 1 · Published 2026-04-01 · Updated 2026-04-30 · CVE-2026-5315

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nothings stb versions up to 1.26

Description A flaw exists in Nothings stb, specifically within the stbtt buf get8 function located in the stb truetype.h library of the TTF File Handler component. This issue can lead to an out-of-bounds read. The vulnerability is remotely exploitable and has been publicly disclosed. The vendor was notified but did not respond.

Recommendations Versions prior to 1.26 should be updated.

Exploit

Fix

Buffer Overflow

Out of bounds Read

Weakness Enumeration

CWE-119

CWE-125

Related Identifiers

CVE-2026-5315

Affected Products

Stb

References · 14

• 🔥 https://gist.github.com/d0razi/c11dd07c75f3b795e4f8bbfd6e2f0d29 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5315 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-5315 · Security Note
• https://ubuntu.com/security/CVE-2026-5315 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-5315 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-5315 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-5315 · Vendor Advisory
• https://twitter.com/cyberbivash/status/2039536516473471263 · Twitter Post
• https://vuldb.com/submit/780559 · Note
• https://twitter.com/CVEarity/status/2039667838177460717 · Twitter Post
• https://vuldb.com/vuln/354647/cti · Note
• https://vuldb.com/vuln/354647 · Note
• https://t.me/cveNotify/161632 · Telegram Post
• https://twitter.com/CVEnew/status/2039647724178673955 · Twitter Post