The vulnerability is a heap–buffer overflow in the stbtt__GetGlyphShapeTT() function of the nothings stb_truetype.h library. When parsing a malformed TrueType font file containing an inflated endPtsOfContours value, the parser attempts to read past the end of the glyph data buffer. This out‑of‑bounds read can reveal contents of memory adjacent to the buffer, potentially exposing sensitive information stored in the process’s address space. The weakness is a classic heap‑based buffer overflow (CWE‑122).

The affected component is the TrueType font parser bundled in the nothings stb library, up to version 1.26. Applications that embed this library—including various game engines, graphics tools, or any software that loads and renders TrueType fonts—are susceptible. No specific third‑party vendors are listed, as the library originates from Sean Barrett (nothings).

The EPSS score is <1%, and the vulnerability is not listed in CISA’s KEV catalog, which suggests limited exploitation data at present. The CVSS score is 7.1, indicating a medium severity. Exploitation requires that an attacker can supply a crafted font to the vulnerable application, either through a user‑controlled file path or a network socket that forwards font data. Successful exploitation would typically lead to an information disclosure or a denial‑of‑service via a crash caused by the buffer overflow.