CVE-2025-15534 raysan5 raylib rtext.c LoadFontData integer overflow

Medium 4.8 Published 18 Jan 2026 Updated 23 Feb 2026

A local attacker can trigger an integer overflow in raylib's font loading function, potentially causing a denial of service.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2025-15534?

CVE-2025-15534 is a medium-severity vulnerability in raysan5 raylib, published on 18 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability was identified in raysan5 raylib up to 909f040. Affected by this issue is the function LoadFontData of the file src/rtext.c. The manipulation leads to integer overflow. The attack can only be performed from a local environment. The exploit is publicly available and might be used. The identifier of the patch is 5a3391fdce046bc5473e52afbd835dd2dc127146. It is suggested to install a patch to address this issue.

Weakness: CWE-190, CWE-189

Which versions are affected by CVE-2025-15534?

It affects 1 product.

Products include Raylib Raylib.

How do I fix CVE-2025-15534?

Apply the vendor's patch.

Is CVE-2025-15534 being exploited?

There is no known exploitation of CVE-2025-15534 in the wild and no public exploit code.

Sources

Also known as GHSA-4696-58w6-rqw4, JLSEC-2026-531.