GHSA-c55g-rp4x-fx84

Source

https://github.com/advisories/GHSA-c55g-rp4x-fx84

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-c55g-rp4x-fx84/GHSA-c55g-rp4x-fx84.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-c55g-rp4x-fx84

Published

2026-05-18T15:38:15Z

Modified

2026-05-18T15:49:39Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

Microsoft DirectX: .spritefont multiply overflow only in 32-bit builds

Details

Impact

The spritefont reader can be induced to perform a 32-bit overflow multiply that could in theory result in a RCE.

This impacts the use of the DirectX Tool Kit SpriteFont class file loading ctor if given untrusted data files.

Note this only applies to x86/ARM builds of the library. ARM64 and x64 native is not subject to this issue.

Patches

This bug has been fixed in the May 7, 2026 release. Alternatively, users can update their copy of the reader as per this commit.

Workarounds

This does not apply if a project's .spritefont files are all 'trusted' data that were included with an application. It's primarily an issue only if developers are using user-provided or network downloaded spritefont files.

Database specific

{
    "cwe_ids":  [
        "CWE-190"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-18T15:38:15Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

NuGet / directxtk_desktop_win10

Package

Name: directxtk_desktop_win10; View open source insights on deps.dev
Purl: pkg:nuget/directxtk_desktop_win10

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2026.5.8.1

Affected versions

2020.*

2020.2.24.4

2020.5.10.1

2020.6.2.1

2020.7.2.1

2020.8.15.1

2020.9.30.1

2020.11.12.1

2021.*

2021.1.10.1

2021.4.7.2

2021.6.10.1

2021.8.2.1

2021.10.1.1

2021.10.15.1

2021.10.19.1

2021.11.8.1

2022.*

2022.3.1.1

2022.3.24.2

2022.5.10.4

2022.7.30.1

2022.10.18.2

2022.12.16.1

2023.*

2023.2.7.1

2023.3.30.1

2023.4.28.1

2023.9.6.1

2023.10.31.1

2024.*

2024.1.1.1

2024.2.22.1

2024.6.5.1

2024.9.5.1

2024.10.29.1

2025.*

2025.3.21.2

2025.7.10.1

2025.10.28.2

2026.*

2026.4.1.1

Database specific

last_known_affected_version_range

"< 2026.4.1.1"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-c55g-rp4x-fx84/GHSA-c55g-rp4x-fx84.json"

NuGet / directxtk_uwp

Package

Name: directxtk_uwp; View open source insights on deps.dev
Purl: pkg:nuget/directxtk_uwp

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2026.5.8.1

Affected versions

2015.*

2015.7.29.1

2015.10.30.1

2015.11.30.1

2016.*

2016.2.23.1

2016.4.26.1

2016.6.30.1

2016.7.18.1

2016.8.4.1

2016.9.1.1

2016.9.15.1

2016.10.6.1

2016.12.5.1

2017.*

2017.2.10.1

2017.4.24.1

2017.6.21.1

2017.9.22.1

2017.12.13.1

2018.*

2018.4.23.1

2018.5.14.1

2018.6.1.2

2018.7.3.1

2018.8.18.2

2018.10.26.1

2018.10.31.1

2018.11.20.1

2019.*

2019.2.7.1

2019.4.26.1

2019.5.31.1

2019.8.23.1

2019.10.17.1

2019.12.17.1