News, updates, trends and the latest
info you need to know about IT

Overview
A heap buffer overflow vulnerability exists in the stb TrueType library created by nothings. Exploitation of this vulnerability can occur when handling malformed font data and may lead to both Denial of Service (DoS) and Information Disclosure.
Description
The nothings stb repository, versions 1.26 and earlier, contains a collection of single-file public domain and MIT-licensed libraries for C/C++ projects.
CVE-2026-18497 A heap buffer overflow vulnerability exists in the stbtt_GetGlyphShape() function within the stb_truetype.h library when handling malformed TrueType Font (TTF) data. The issue occurs during glyph contour parsing. The function iterates based on the number of contour endpoints specified in endPtsOfContours, but does not validate that the points pointer remains within the bounds of the glyph data buffer. As a result, operations such as flags = *points++; may read memory beyond the allocated region.
An attacker can exploit this vulnerability by crafting a TTF file that specifies an excessively large endPtsOfContours value while providing truncated or minimal glyph data. When an application utilizing stb_truetype.h attempts to load, bake, or render this malformed font via stbtt_GetGlyphShape(), the parser will continue iterating past the end of the glyph data buffer, triggering the out-of-bounds heap read.
Impact
Exploitation of this vulnerability can lead to application crashes due to invalid reads of unmapped memory addresses, resulting in denial of service (DoS). In some cases, an attacker may also be able to read data from adjacent heap memory.
Solution
Unfortunately, we were unable to reach the stb maintainers to coordinate this vulnerability. Users are advised to monitor the project’s GitHub repository for updates and install the latest version of this library once a fix has been released. At the time of this writing, the maintainer of this repository had the following message posted on the project’s README page: “This project discusses security-relevant bugs in public in Github Issues and Pull Requests, and it may take significant time for security fixes to be implemented or merged. If this poses an unreasonable risk to your project, do not use stb libraries.”
Acknowledgements
Thank you to Yanzhao Shen for reporting this vulnerability. This document was written by Bob Kemerer.

Critical hardening steps for water, power, and municipal utilities.

Overview
A cross-site scripting (XSS) vulnerability in Alinto SOGo v5.12.7 allows attackers to achieve remote code execution by embedding malicious SVG (Scalable Vector Graphics) objects in ICS (iCalendar) invitations. The vulnerability has been actively exploited in the wild, as confirmed by VirusTotal sightings.
Description
Alinto SOGo is an open-source webmail and groupware platform for email, calendars, contacts, and shared scheduling. It is primarily used by organizations seeking a self-hosted interface solution for existing mail infrastructure.
CVE-2026-8496
The vulnerability exists in SOGo’s handling of ICS files, where the DESCRIPTION field is rendered without proper sanitization or Content Security Policy (CSP) enforcement. When a calendar invite contains an SVG payload, such as <animate onrepeat=’…’>, with JavaScript event handlers, the browser executes the script in the context of the SOGo webmail interface. This occurs during normal calendar view rendering (e.g., when a user opens or previews the calendar tab), even without explicit interaction.
Impact
Once an attacker delivers a malicious ICS file via email, any user who views the calendar will execute the embedded XSS payload, granting the attacker full read access to the victim’s mailbox. This enables:
Credential theft through forced logout/login phishing
Password manager autofill hijacking
Full exfiltration of email messages, folder contents, and metadata
Extraction of contact lists and calendar data
Solution
Users are recommended to upgrade to SOGo v5.12.8 or newer. v5.12.8 addresses this issue via sanitizing ICS DESCRIPTION content and stricter handling of embedded SVG and HTML.
Acknowledgements
Thank you to Greg Lesnewich for reporting this issue. This AI-assisted vulnerability note was prepared by Alexander Curtis.