The stb single-file library contains a function stbtt__buf_get8 in stb_truetype.h that reads a byte from a truetype font buffer without validating the index. This omission allows a crafted TTF file to trigger an out-of-bounds read, a type of buffer over-read (CWE‑119/CWE‑125). Reading beyond the allocated buffer can reveal arbitrary memory contents of the process that loads the font, thereby enabling sensitive data disclosure.

The affected vendor is Nothings, specifically the stb library included in versions up to and including 1.26. The vulnerability is limited to the stb_truetype module, responsible for parsing TrueType font files. No other product or vendor is listed, and the disclosure does not indicate additional impacted components.

The stated CVSS score of 5.3 categorizes this issue as moderate in severity. No EPSS score is available, so the likelihood of exploitation cannot be quantified; however, the description notes that the attack can be performed remotely and public exploits exist. The vulnerability is not in the CISA KEV catalog, but its remote nature combined with a moderate severity indicates a noticeable risk of accidental or intentional data exposure if a malicious font file is processed.