This vulnerability involves an out-of-bounds read in the stbtt_InitFont_internal function of the stb_truetype.h library, part of the Nothings stb project up to version 1.26. The flaw allows remote attackers to cause the software to read memory beyond allocated boundaries by manipulating input data. This can lead to potential information disclosure or application instability. The vulnerability has a CVSS 4.0 score of 5.3 (medium severity), with no privileges required and no user interaction needed for exploitation. The vendor was contacted but has not issued a response or patch. Exploit code is publicly available, increasing the risk of exploitation. No official remediation or patch links are provided, and the product is not a cloud service.

The vulnerability allows remote attackers to perform out-of-bounds reads in the affected function, which may lead to information disclosure or application crashes. The medium CVSS score reflects a moderate impact, with no privilege or user interaction required. Although exploit code is public, no active exploitation in the wild has been confirmed. Lack of vendor response means no official fix or mitigation is currently available.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official patch is available, users should consider mitigating exposure by avoiding untrusted input to the affected function or library. Monitor for updates from the vendor or community for any forthcoming fixes or workarounds.