GHSA-C55G-RP4X-FX84中危已审查

Microsoft DirectX: .spritefont multiply overflow only in 32-bit builds

OSV 1.4.0 · github-reviewed · 修改于 2026-05-18 23:38

发布时间

2026-05-18 23:38

GitHub 审查时间

2026-05-18 23:38

NVD 发布时间

—

源文件

advisories/github-reviewed/2026/05/GHSA-c55g-rp4x-fx84/GHSA-c55g-rp4x-fx84.json

公告说明

Impact

The spritefont reader can be induced to perform a 32-bit overflow multiply that could in theory result in a RCE.

This impacts the use of the DirectX Tool Kit SpriteFont class file loading ctor if given untrusted data files.

Note this only applies to x86/ARM builds of the library. ARM64 and x64 native is not subject to this issue.

Patches

This bug has been fixed in the May 7, 2026 release. Alternatively, users can update their copy of the reader as per this commit.

Workarounds

This does not apply if a project's .spritefont files are all 'trusted' data that were included with an application. It's primarily an issue only if developers are using user-provided or network downloaded spritefont files.

受影响的软件包

NuGet

directxtk_desktop_win10

标识信息

别名 / CVE

无

CWE

CWE-190

软件生态

NuGet

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V4

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

原始 OSV JSON

{
  "id": "GHSA-c55g-rp4x-fx84",
  "aliases": [],
  "details": "### Impact\nThe spritefont reader can be induced to perform a 32-bit overflow multiply that could in theory result in a RCE.\n\nThis impacts the use of the *DirectX Tool Kit* **SpriteFont** class file loading ctor if given untrusted data files.\n\n> Note this only applies to x86/ARM builds of the library. ARM64 and x64 native is not subject to this issue.\n\n### Patches\nThis bug has been fixed in the May 7, 2026 release. Alternatively, users can update their copy of the reader as per [this commit](https://github.com/microsoft/DirectXTK/commit/ef1bd5d7f492c39dd0cd87493ba8ea38725c9791).\n\n### Workarounds\nThis does not apply if a project's .spritefont files are all 'trusted' data that were included with an application. It's primarily an issue only if developers are using user-provided or network downloaded spritefont files.",
  "summary": "Microsoft DirectX: .spritefont multiply overflow only in 32-bit builds",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.5.8.1"
            }
          ]
        }
      ],
      "package": {
        "name": "directxtk_desktop_win10",
        "ecosystem": "NuGet"
      },
      "database_specific": {
        "last_known_affected_version_range": "< 2026.4.1.1"
      }
    },
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.5.8.1"
            }
          ]
        }
      ],
      "package": {
        "name": "directxtk_uwp",
        "ecosystem": "NuGet"
      },
      "database_specific": {
        "last_known_affected_version_range": "< 2026.4.1.1"
      }
    }
  ],
  "modified": "2026-05-18T15:38:15Z",
  "severity": [
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"
    }
  ],
  "published": "2026-05-18T15:38:15Z",
  "references": [
    {
      "url": "https://github.com/microsoft/DirectXTK/security/advisories/GHSA-c55g-rp4x-fx84",
      "type": "WEB"
    },
    {
      "url": "https://github.com/microsoft/DirectXTK/commit/ef1bd5d7f492c39dd0cd87493ba8ea38725c9791",
      "type": "WEB"
    },
    {
      "url": "https://github.com/microsoft/DirectXTK",
      "type": "PACKAGE"
    },
    {
      "url": "https://github.com/microsoft/DirectXTK/releases/tag/may2026",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-190"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2026-05-18T15:38:15Z"
  }
}