EIP-2026-114956

PRE-CVE

Avast! - Integer Overflow Verifying numFonts in TTC Header

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-114956. PoCs published by Google Security Research.

AI-analyzed exploit summary The exploit describes an integer overflow vulnerability in the TTC header parsing logic, specifically in the `filevirus_ttf()` function when processing the `numFonts` field. The issue occurs due to improper bounds checking, leading to a buffer overflow when `numFonts` exceeds `(SIZE_MAX+1) / 4`.

Description

Avast! - Integer Overflow Verifying numFonts in TTC Header

Exploits (1)

exploitdb WRITEUP VERIFIED
by Google Security Research · textdoswindows
https://www.exploit-db.com/exploits/38934

The exploit describes an integer overflow vulnerability in the TTC header parsing logic, specifically in the `filevirus_ttf()` function when processing the `numFonts` field. The issue occurs due to improper bounds checking, leading to a buffer overflow when `numFonts` exceeds `(SIZE_MAX+1) / 4`.

Classification
Writeup 90%
Attack Type
Dos
Complexity
Moderate
Reliability
Theoretical
Target: Software processing TTC (TrueType Collection) fonts
No auth needed
Prerequisites: A maliciously crafted TTC file with an excessively large `numFonts` value
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026