Sean Barrett (nothings) CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH Sean Barrett (nothings) CVE published 2026-08-07

CVE-2026-18497

A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, used for parsing TrueType font files. The vulnerability is in the stbtt__GetGlyphShapeTT() function within the nothings stb_truetype.h library when parsing malformed TTF (TrueType Font) files. An attacker can craft a malformed TTF file with an inflated endPtsOfContours value and truncate the remaining gly [truncated]