Nothings Stb Truetype.h — known CVE vulnerabilities

Every CVE whose affected-product data names Nothings Stb Truetype.h, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (12)

• CVE-2020-6617 — CVSS 8.8 (high): stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_int.
• CVE-2020-6618 — CVSS 8.8 (high): stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__find_table.
• CVE-2020-6619 — CVSS 8.8 (high): stb stb_truetype.h through 1.22 has an assertion failure in stbtt__buf_seek.
• CVE-2020-6620 — CVSS 8.8 (high): stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_get8.
• CVE-2020-6621 — CVSS 8.8 (high): stb stb_truetype.h through 1.22 has a heap-based buffer over-read in ttUSHORT.
• CVE-2020-6622 — CVSS 8.8 (high): stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_peek8.
• CVE-2020-6623 — CVSS 8.8 (high): stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_get_index.
• CVE-2022-25514 — CVSS 7.5 (high): stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttUSHORT() at stb_truetype.h. NOTE: Third party has…
• CVE-2022-25515 — CVSS 6.5 (medium): stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttULONG() at stb_truetype.h. NOTE: Third party has…
• CVE-2022-25516 — CVSS 6.5 (medium): stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function stbtt__find_table at stb_truetype.h. NOTE: Third…
• CVE-2026-5314 — CVSS 4.3 (medium): A vulnerability was found in Nothings stb up to 1.26. Impacted is the function stbtt_InitFont_internal in the library stb_truetype.h of the…
• CVE-2026-5315 — CVSS 4.3 (medium): A vulnerability was determined in Nothings stb up to 1.26. The affected element is the function stbtt__buf_get8 in the library…