VU#987105: The nothings stb TrueType library, up to version 1.26, contains a heap buffer overflow vulnerability

Researchers found font-rendering trick to hide malicious commands