Connect your agent
AdvisoriesCriticalCheck your lockfilePluginHow it worksPricing Connect your agent

Advisory record · GHSA-5r97-79vw-qvm4

Microsoft DirectX12: .spritefont multiply overflow only in 32-bit builds

CVSS 4.0, no score published

Published by the GitHub Advisory Database at 18 May 2026, 15:38 UTC. agentprime has not analysed this yet, so whether it affects any app is not known.

PackageEcosystemAffectedFixed in
directxtk12_desktop_win10NuGet<2026.5.8.12026.5.8.1
directxtk12_uwpNuGet<2026.5.8.12026.5.8.1
Identifiers
GHSA-5r97-79vw-qvm4
Weakness (CWE)
CWE-190
Tags
Published
18 May 2026
Updated
18 May 2026

Machine-written summary

Summary written by Claude Haiku from the source advisory. Not reviewed by a person.

Two NuGet packages, directxtk12_desktop_win10 and directxtk12_uwp, are affected in versions before 2026.5.8.1; version 2026.5.8.1 fixes them. The issue is a 32-bit overflow in the SpriteFont file loader that could in theory lead to remote code execution, but only in x86 and ARM builds, and only when the loader is given untrusted spritefont files. Upgrade to 2026.5.8.1 or later. If you only load spritefont files bundled with your application, you are not affected.

Written 9 Nov 2026.

Not analysed yet

We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.

Severity and exploitation

ScoreRatingCVSSVectorSource
Not published None 4.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N GitHub Advisory Database
  • CISA KEV Not listed.
  • EPSS No score.

Timeline

  1. 31 Oct 2026, 15:22 UTC First seen by agentprime
  2. 31 Oct 2026, 15:22 UTC Confirmed by OSV

Sources

Facts on this page come from the GitHub Advisory Database (CC-BY 4.0), OSV and the other sources listed, as published. We don’t reproduce full advisory descriptions, which can contain exploit code.