Loading...
Skip to main content
GeekWala

GHSA-5r97-79vw-qvm4 — Vulnerability in directxtk12_uwp — Advisory...

MEDIUM

Microsoft DirectX12: .spritefont multiply overflow only in 32-bit builds

Published May 18, 2026Updated May 18, 2026Source: osv

Summary

### Impact The spritefont reader can be induced to perform a 32-bit overflow multiply that could in theory result in a RCE. This impacts the use of the *DirectX Tool Kit* **SpriteFont** class file loading ctor if given untrusted data files. > Note this only applies to x86/ARM builds of the library. ARM64 and x64 native is not subject to this issue. ### Patches This bug has been fixed in the May 7, 2026 release. Alternatively, you can just update your copy of the reader as per [this commit](https://github.com/microsoft/DirectXTK12/commit/c037a024a7ed3b2162fa2bbbe209b84ba2904494). ### Workarounds This does not apply if a project's .spritefont files are all 'trusted' data that were included with an application. It's primarily an issue only if developers are using user-provided or network downloaded spritefont files.

Advisory Timeline

  • First published May 18, 2026 (147 days ago).
  • Last revised May 18, 2026 — 0 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

NuGet
Update directxtk12_uwp to 2026.5.8.1 or later
dotnet add package directxtk12_uwp --version 2026.5.8.1
NuGet
Update directxtk12_desktop_win10 to 2026.5.8.1 or later
dotnet add package directxtk12_desktop_win10 --version 2026.5.8.1

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

Affects 1 ecosystem: nuget (2).

PackageEcosystemAffectedFixed In
directxtk12_uwp
nuget
2016.10.6.1, 2016.12.5.1, 2016.6.30.1, 2016.7.18.1 (+59 more)2026.5.8.1
directxtk12_desktop_win10
nuget
2025.10.28.1, 2025.3.21.3, 2025.7.10.1, 2026.4.1.12026.5.8.1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 7.3 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
—
Confidentiality
—
Integrity
—
Availability
—

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

Frequently Asked Questions

What is GHSA-5r97-79vw-qvm4?
Microsoft DirectX12: .spritefont multiply overflow only in 32-bit builds This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 7.3/10).
How do I check if my project is affected by GHSA-5r97-79vw-qvm4?
GHSA-5r97-79vw-qvm4 affects directxtk12_uwp and directxtk12_desktop_win10. Use GeekWala's free vulnerability scanner to check your dependencies against GHSA-5r97-79vw-qvm4 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
7.3

High exploitability or significant impact. Prioritize remediation within days.

Related CVEs

  • CVE-2026-106111
    MEDIUM

    ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate

  • CVE-2026-65829
    MEDIUM

    MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers

More NuGet advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies