Local Access Vulnerability in nicbarker Clay Library Affecting Measure Text Function
CVE-2025-15535

4.8MEDIUM

Key Information:

Vendor: Nicbarker
Status: Clay
Vendor: CVE Published:; 18 January 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-15535?

A security flaw exists in the nicbarker Clay library up to version 0.14, specifically within the Clay__MeasureTextCached function found in clay.h. This vulnerability allows for a null pointer dereference, which can lead to unintended behavior or system crashes. As it requires local access for exploitation, this raises concerns for systems where unauthorized local access may occur. Although the project was made aware of this issue through an issue report, no public response has been documented yet. Given that the exploit has been released publicly, it poses a risk to unpatched systems.

Affected Version(s)

clay 0.1

clay 0.2

clay 0.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-15535 - Proof of Concept