CVE-2025-15534

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A vulnerability was identified in raysan5 raylib up to 909f040. Affected by this issue is the function LoadFontData of the file src/rtext.c. The manipulation leads to integer overflow. The attack can only be performed from a local environment. The exploit is publicly available and might be used. The identifier of the patch is 5a3391fdce046bc5473e52afbd835dd2dc127146. It is suggested to install a patch to address this issue.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-189 CWE-190

Affected software

No affected versions have been published.

Timeline

Published: Jan 18, 2026
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-155353.3A security flaw has been discovered in nicbarker clay up to 0.14. This affects the function Clay__MeasureTextCached in the library clay.h. T CVE-2025-155365.5A weakness has been identified in BYVoid OpenCC up to 1.1.9. This vulnerability affects the function opencc::MaxMatchSegmentation of the fil CVE-2025-155375.5A security vulnerability has been detected in Mapnik up to 4.2.0. This issue affects the function mapnik::dbf_file::string_value of the file CVE-2025-155387.8A security vulnerability has been detected in Open Asset Import Library Assimp up to 6.0.2. Affected by this vulnerability is the function A CVE-2025-155397.5A vulnerability was determined in Open5GS up to 2.7.6. Impacted is the function sgwc_s11_handle_downlink_data_notification_ack of the file s CVE-2025-155408.8"Functions" module in Raytha CMS allows privileged users to write custom code to add functionality to application. Due to a lack of sandboxi CVE-2025-155416.3Improper link resolution in the VX800v v1.0 SFTP service allows authenticated adjacent attackers to use crafted symbolic links to access sys CVE-2025-155425.3Improper handling of exceptional conditions in VX800v v1.0 in SIP processing allows an attacker to flood the device with crafted INVITE mess CVE-2025-155434.6Improper link resolution in USB HTTP access path in VX800v v1.0 allows a crafted USB device to expose root filesystem contents, giving an at CVE-2025-155445.9A cryptographic weakness exists in the Omada device adoption process. During adoption, authentication credentials associated with site mana CVE-2025-155456.8The backup restore function does not properly validate unexpected or unrecognized tags within the backup file. When such a crafted file is r CVE-2025-155465.4The Iptanus File Upload WordPress plugin before 5.1.7 does not implement proper file handling when the duplicatepolicy setting is configured