EIP-2026-114956

The exploit describes an integer overflow vulnerability in the TTC header parsing logic, specifically in the `filevirus_ttf()` function when processing the `numFonts` field. The issue occurs due to improper bounds checking, leading to a buffer overflow when `numFonts` exceeds `(SIZE_MAX+1) / 4`.