Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2020-6622: stb_truetype.h may read past memory
CVE-2020-6622 · published 6 years ago
Summary
The stb_truetype.h library (versions up to 1.22) can mistakenly read data beyond the end of a memory buffer. This could cause the program using the library to behave unexpectedly or crash. Update to a newer version of stb_truetype.h or apply the vendor’s patch to prevent the over‑read.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | nothings | stb_truetype.h |
<= 1.22 cpe:2.3:a:nothings:stb_truetype.h:*:*:*:*:*:*:*:* |
| Ubuntu:20.04:LTS | canonical | libstb | All versions |
Original advisory text
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_peek8.
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_peek8.
References
- https://github.com/nothings/stb/issues/869 Third Party Advisory
- https://ubuntu.com/security/CVE-2020-6622 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2020-6622 Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-125Out-of-bounds Read
Timeline
Published8 Jan 2020
Updated4 Nov 2026
First seen29 Sep 2026
Track software like this
Free during beta