Loading...
Skip to main content
GeekWala

GHSA-c55g-rp4x-fx84 — Vulnerability in directxtk_uwp — Advisory...

MEDIUM

Microsoft DirectX: .spritefont multiply overflow only in 32-bit builds

Published May 18, 2026Updated May 18, 2026Source: osv

Summary

### Impact The spritefont reader can be induced to perform a 32-bit overflow multiply that could in theory result in a RCE. This impacts the use of the *DirectX Tool Kit* **SpriteFont** class file loading ctor if given untrusted data files. > Note this only applies to x86/ARM builds of the library. ARM64 and x64 native is not subject to this issue. ### Patches This bug has been fixed in the May 7, 2026 release. Alternatively, users can update their copy of the reader as per [this commit](https://github.com/microsoft/DirectXTK/commit/ef1bd5d7f492c39dd0cd87493ba8ea38725c9791). ### Workarounds This does not apply if a project's .spritefont files are all 'trusted' data that were included with an application. It's primarily an issue only if developers are using user-provided or network downloaded spritefont files.

Advisory Timeline

  • First published May 18, 2026 (147 days ago).
  • Last revised May 18, 2026 — 0 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

NuGet
Update directxtk_uwp to 2026.5.8.1 or later
dotnet add package directxtk_uwp --version 2026.5.8.1
NuGet
Update directxtk_desktop_win10 to 2026.5.8.1 or later
dotnet add package directxtk_desktop_win10 --version 2026.5.8.1

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

Affects 1 ecosystem: nuget (2).

PackageEcosystemAffectedFixed In
directxtk_uwp
nuget
2015.10.30.1, 2015.11.30.1, 2015.7.29.1, 2016.10.6.1 (+62 more)2026.5.8.1
directxtk_desktop_win10
nuget
2020.11.12.1, 2020.2.24.4, 2020.5.10.1, 2020.6.2.1 (+31 more)2026.5.8.1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 7.3 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
—
Confidentiality
—
Integrity
—
Availability
—

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

Frequently Asked Questions

What is GHSA-c55g-rp4x-fx84?
Microsoft DirectX: .spritefont multiply overflow only in 32-bit builds This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 7.3/10).
How do I check if my project is affected by GHSA-c55g-rp4x-fx84?
GHSA-c55g-rp4x-fx84 affects directxtk_uwp and directxtk_desktop_win10. Use GeekWala's free vulnerability scanner to check your dependencies against GHSA-c55g-rp4x-fx84 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
7.3

High exploitability or significant impact. Prioritize remediation within days.

Related CVEs

  • CVE-2026-106111
    MEDIUM

    ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate

  • CVE-2026-65829
    MEDIUM

    MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers

More NuGet advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies