CVE-2025-15534
📋 TL;DR
An integer overflow vulnerability in raylib's LoadFontData function allows local attackers to cause denial of service or potentially execute arbitrary code. This affects raylib users who load font data from untrusted sources. The vulnerability requires local access to exploit.
💻 Affected Systems
- raysan5 raylib
📦 What is this software?
Raylib by Raylib
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to arbitrary code execution with the privileges of the raylib process
Likely Case
Application crash or denial of service when processing malicious font files
If Mitigated
Limited impact due to local-only exploitation requirement and proper input validation
🎯 Exploit Status
Exploit requires local access and ability to supply malicious font data to the application
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit 5a3391fdce046bc5473e52afbd835dd2dc127146 and later
Vendor Advisory: https://github.com/raysan5/raylib/issues/5436
Restart Required: Yes
Instructions:
Update raylib to commit 5a3391fdce046bc5473e52afbd835dd2dc127146 or later
Rebuild applications using the patched raylib library
Restart affected applications
🔧 Temporary Workarounds
Restrict font file sources
allOnly load font files from trusted sources and validate font files before processing
Disable font loading from untrusted sources
allModify application to avoid loading fonts from user-controlled or untrusted locations
🧯 If You Can't Patch
- Implement strict input validation for font files before passing to LoadFontData
- Run raylib applications with minimal privileges to limit potential damage
🔍 How to Verify
Check if Vulnerable:
Check raylib version or commit hash - if earlier than commit 5a3391fdce046bc5473e52afbd835dd2dc127146, it's vulnerableCheck Version:
Check raylib source code or build information for commit hashVerify Fix Applied:
Verify raylib is at commit 5a3391fdce046bc5473e52afbd835dd2dc127146 or later📡 Detection & Monitoring
Log Indicators:
- Application crashes when loading font files
- Memory access violations in rtext.c functions
Network Indicators:
- None - local-only vulnerability
SIEM Query:
Process crashes with raylib or related to font loading operations🔗 References
- https://github.com/oneafter/1224/blob/main/segv1
- https://github.com/raysan5/raylib/
- https://github.com/raysan5/raylib/commit/5a3391fdce046bc5473e52afbd835dd2dc127146
- https://github.com/raysan5/raylib/issues/5436
- https://github.com/raysan5/raylib/pull/5450
- https://vuldb.com/?ctiid.341706
- https://vuldb.com/?id.341706
- https://vuldb.com/?submit.733343
