PT-2026-3379 · Raylib · Raylib

Oneafter · Published 2026-01-18 · Updated 2026-01-19 · CVE-2025-15533

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions raylib versions prior to 909f040

Description A heap-based buffer overflow exists in the GenImageFontAtlas function within the src/rtext.c file. This issue can be triggered through local manipulation. The vulnerability has been publicly disclosed.

Recommendations Apply patch 5a3391fdce046bc5473e52afbd835dd2dc127146 to resolve this issue.

Exploit

Fix

Buffer Overflow

Heap Based Buffer Overflow

Weakness Enumeration

CWE-119

CWE-122

Related Identifiers

CVE-2025-15533

OPENSUSE-SU-2026:10071-1

OPENSUSE-SU-2026:20717-1

Affected Products

Raylib

References · 16

• 🔥 https://github.com/oneafter/1224/blob/main/hbf2 · Exploit
• https://github.com/raysan5/raylib/issues/5433 · Vendor Advisory
• https://github.com/raysan5/raylib/commit/5a3391fdce046bc5473e52afbd835dd2dc127146 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-15533 · Security Note
• https://osv.dev/vulnerability/CVE-2025-15533 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10071-1 · Vendor Advisory
• https://github.com/raysan5/raylib/pull/5450 · Note
• https://github.com/raysan5/raylib · Note
• https://vuldb.com/?id.341705 · Note
• https://suse.com/security/cve/CVE-2025-15534 · Note
• https://vuldb.com/?submit.733341 · Note
• https://twitter.com/VulmonFeeds/status/2012763327194177692 · Twitter Post
• https://twitter.com/CVEnew/status/2012763615900938280 · Twitter Post
• https://vuldb.com/?submit.733342 · Note
• https://suse.com/security/cve/CVE-2025-15533 · Note