PT-2026-3383 · Unknown · Nicbarker Clay

Oneafter · Published 2026-01-18 · Updated 2026-01-18 · CVE-2025-15535

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions nicbarker clay versions up to 0.14

Description A security flaw exists in nicbarker clay up to version 0.14. The issue resides within the Clay MeasureTextCached function in the clay.h library and results in a null pointer dereference. Exploitation requires local access. The exploit has been publicly released. The project was notified of the issue but has not yet responded.

Recommendations Versions prior to 0.14 should be used.

Exploit

Fix

NULL Pointer Dereference

Improper Resource Release

Weakness Enumeration

CWE-476

CWE-404

Related Identifiers

CVE-2025-15535

Affected Products

Nicbarker Clay

References · 10

• 🔥 https://github.com/oneafter/1215/blob/main/repro · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-15535 · Security Note
• https://osv.dev/vulnerability/CVE-2025-15535 · Vendor Advisory
• https://github.com/nicbarker/clay/issues/566 · Note
• https://vuldb.com/?submit.733346 · Note
• https://vuldb.com/?ctiid.341707 · Note
• https://twitter.com/VulmonFeeds/status/2012832500813307982 · Twitter Post
• https://github.com/nicbarker/clay · Note
• https://twitter.com/CVEnew/status/2012831857478684702 · Twitter Post
• https://vuldb.com/?id.341707 · Note