A heap buffer overflow vulnerability has been identified in the stb TrueType library, specifically in versions 1.26 and earlier. This vulnerability arises from improper handling of malformed TrueType Font (TTF) data within the stbtt_GetGlyphShape() function. The issue occurs during the parsing of glyph contours, where the function iterates based on contour endpoint information. However, it fails to validate that the pointer for these points stays within the allocated glyph data buffer's boundaries. An attacker can exploit this by creating a malicious TTF file with an oversized endpoint count and insufficient glyph data. When an application processes this malformed font using stbtt_GetGlyphShape(), it can lead to out-of-bounds reading of heap memory. The primary impact of this vulnerability is Denial of Service (DoS) due to application crashes from invalid memory access. Additionally, attackers might be able to disclose sensitive information by reading adjacent heap memory. Unfortunately, the stb maintainers have not yet been reachable to coordinate a fix, so users should monitor the project's GitHub for updates. As a precautionary measure, users are advised to consider the warning on the project's README regarding potential delays in security fixes.