Executive brief
A vulnerability exists in the Microsoft DirectX Tool Kit, a library used by developers to manage graphics and game assets. When an application built with this library for 32-bit systems (x86 or ARM) processes a specially crafted font file, it can cause a memory error. This could potentially allow an attacker to execute unauthorized code or crash the application if it processes untrusted files from the internet or users.
Technical details
An integer overflow (CWE-190) exists in the SpriteFont class file loading constructor within the Microsoft DirectX Tool Kit (DirectXTK). The vulnerability is triggered by a 32-bit multiply overflow when the spritefont reader processes malformed or untrusted '.spritefont' data files. This issue specifically affects 32-bit architectures (x86 and ARM); 64-bit builds (x64 and ARM64) are not impacted. An attacker could exploit this to achieve remote code execution (RCE) if they can induce an application to load a malicious font file. The issue has been patched in version 2026.5.8.1.
Affected products
- Microsoft DirectXTK (DirectX Tool Kit) < 2026.4.1.1
Timeline
- 2026-05-07: patched: Fix included in the May 2026 release
- 2026-05-11: disclosed: Initial disclosure by maintainer
- 2026-05-18: advisory: GitHub Advisory published
References
- https://github.com/microsoft/DirectXTK/security/advisories/GHSA-c55g-rp4x-fx84
- https://github.com/microsoft/DirectXTK/commit/ef1bd5d7f492c39dd0cd87493ba8ea38725c9791
- https://github.com/microsoft/DirectXTK/releases/tag/may2026
- https://api.github.com/repos/microsoft/DirectXTK/security-advisories/GHSA-c55g-rp4x-fx84