CVE-2026-5317 | Medium | 6.3 | 2026-04-02 | A security flaw has been discovered in Nothings stb up to 1.22. This affects the function start_decoder of the file stb_vorbis.c. The manipulation results in o… |
CVE-2026-5316 | Medium | 4.3 | 2026-04-02 | A vulnerability was identified in Nothings stb up to 1.22. The impacted element is the function setup_free of the file stb_vorbis.c. The manipulation leads to… |
CVE-2026-5315 | Medium | 4.3 | 2026-04-02 | A vulnerability was determined in Nothings stb up to 1.26. The affected element is the function stbtt__buf_get8 in the library stb_truetype.h of the component… |
CVE-2026-5314 | Medium | 4.3 | 2026-04-01 | A vulnerability was found in Nothings stb up to 1.26. Impacted is the function stbtt_InitFont_internal in the library stb_truetype.h of the component TTF File… |
CVE-2026-5313 | Medium | 4.3 | 2026-04-01 | A vulnerability has been found in Nothings stb up to 2.30. This issue affects the function stbi__gif_load_next in the library stb_image.h of the component GIF… |
CVE-2026-5186 | Medium | 5.3 | 2026-03-31 | A weakness has been identified in Nothings stb up to 2.30. This impacts the function stbi__load_gif_main of the file stb_image.h of the component Multi-frame G… |
CVE-2026-5185 | Medium | 5.3 | 2026-03-31 | A security flaw has been discovered in Nothings stb_image up to 2.30. This affects the function stbi__gif_load_next of the file stb_image.h of the component Mu… |
CVE-2025-3409 | Medium | 6.3 | 2025-04-08 | A vulnerability classified as critical has been found in Nothings stb up to f056911. This affects the function stb_include_string. The manipulation of the argu… |
CVE-2025-3408 | Medium | 6.3 | 2025-04-08 | A vulnerability was found in Nothings stb up to f056911. It has been rated as critical. Affected by this issue is the function stb_dupreplace. The manipulation… |
CVE-2025-3407 | Medium | 6.3 | 2025-04-08 | A vulnerability was found in Nothings stb up to f056911. It has been declared as critical. Affected by this vulnerability is the function stbhw_build_tileset_f… |
CVE-2025-3406 | Medium | 4.3 | 2025-04-08 | A vulnerability was found in Nothings stb up to f056911. It has been classified as problematic. Affected is the function stbhw_build_tileset_from_image of the… |
CVE-2023-47212 | Critical | 9.8 | 2024-05-01 | A heap-based buffer overflow vulnerability exists in the comment functionality of stb _vorbis.c v1.22. A specially crafted .ogg file can lead to an out-of-boun… |
CVE-2023-43281 | Medium | 6.5 | 2023-10-25 | Double Free vulnerability in Nothings Stb Image.h v.2.28 allows a remote attacker to cause a denial of service via a crafted file to the stbi_load_gif_main fun… |
CVE-2023-45682 | Medium | 5.3 | 2023-10-21 | stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds read in `DECODE` macro when `var` is… |
CVE-2023-45681 | High | 7.3 | 2023-10-21 | stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory write past an allocated heap buffer in `sta… |
CVE-2023-45680 | Medium | 5.3 | 2023-10-21 | stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory allocation failure in `start_decoder`. In t… |
CVE-2023-45679 | High | 7.3 | 2023-10-21 | stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory allocation failure in `start_decoder`. In t… |
CVE-2023-45678 | Medium | 6.5 | 2023-10-21 | stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of buffer write in `start_decoder` because at… |
CVE-2023-45677 | High | 7.3 | 2023-10-21 | stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[len] = (char)'\0… |
CVE-2023-45676 | High | 7.3 | 2023-10-21 | stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[i] = get8_packet… |
CVE-2023-45675 | Medium | 6.5 | 2023-10-21 | stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[len] = (char)'\0… |
CVE-2023-45667 | Medium | 5.3 | 2023-10-21 | stb_image is a single file MIT licensed library for processing images.
If `stbi__load_gif_main` in `stbi_load_gif_from_memory` fails it returns a null pointer… |
CVE-2023-45666 | High | 7.3 | 2023-10-21 | stb_image is a single file MIT licensed library for processing images. It may look like `stbi__load_gif_main` doesn’t give guarantees about the content of out… |
CVE-2023-45664 | High | 7.3 | 2023-10-21 | stb_image is a single file MIT licensed library for processing images. A crafted image file can trigger `stbi__load_gif_main_outofmem` attempt to double-free t… |
CVE-2023-45663 | Medium | 5.3 | 2023-10-21 | stb_image is a single file MIT licensed library for processing images. The stbi__getn function reads a specified number of bytes from context (typically a file… |
CVE-2023-45662 | Medium | 6.5 | 2023-10-21 | stb_image is a single file MIT licensed library for processing images. When `stbi_set_flip_vertically_on_load` is set to `TRUE` and `req_comp` is set to a numb… |
CVE-2023-45661 | Medium | 6.5 | 2023-10-21 | stb_image is a single file MIT licensed library for processing images. A crafted image file may trigger out of bounds memcpy read in `stbi__gif_load_next`. Thi… |
CVE-2023-43898 | Medium | 5.5 | 2023-10-03 | Nothings stb 2.28 was discovered to contain a Null Pointer Dereference via the function stbi__convert_format. This vulnerability allows attackers to cause a De… |
CVE-2022-28042 | High | 8.8 | 2022-04-15 | stb_image.h v2.27 was discovered to contain an heap-based use-after-free via the function stbi__jpeg_huff_decode. |
CVE-2022-28041 | Medium | 6.5 | 2022-04-15 | stb_image.h v2.27 was discovered to contain an integer overflow via the function stbi__jpeg_decode_block_prog_dc. This vulnerability allows attackers to cause… |
CVE-2022-25516 | Medium | 6.5 | 2022-03-17 | stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function stbtt__find_table at stb_truetype.h. NOTE: Third party has disputed stat… |
CVE-2022-25515 | Medium | 6.5 | 2022-03-17 | stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttULONG() at stb_truetype.h. NOTE: Third party has disputed stating that… |
CVE-2022-25514 | High | 7.5 | 2022-03-17 | stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttUSHORT() at stb_truetype.h. NOTE: Third party has disputed stating tha… |
CVE-2021-42716 | High | 7.1 | 2021-10-21 | An issue was discovered in stb stb_image.h 2.27. The PNM loader incorrectly interpreted 16-bit PGM files as 8-bit when converting to RGBA, leading to a buffer… |
CVE-2021-42715 | Medium | 5.5 | 2021-10-21 | An issue was discovered in stb stb_image.h 1.33 through 2.27. The HDR loader parsed truncated end-of-file RLE scanlines as an infinite sequence of zero-length… |
CVE-2020-6623 | High | 8.8 | 2020-01-08 | stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_get_index. |
CVE-2020-6622 | High | 8.8 | 2020-01-08 | stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_peek8. |
CVE-2020-6621 | High | 8.8 | 2020-01-08 | stb stb_truetype.h through 1.22 has a heap-based buffer over-read in ttUSHORT. |
CVE-2020-6620 | High | 8.8 | 2020-01-08 | stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_get8. |
CVE-2020-6619 | High | 8.8 | 2020-01-08 | stb stb_truetype.h through 1.22 has an assertion failure in stbtt__buf_seek. |
CVE-2020-6618 | High | 8.8 | 2020-01-08 | stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__find_table. |
CVE-2020-6617 | High | 8.8 | 2020-01-08 | stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_int. |
CVE-2019-20056 | Medium | 6.5 | 2019-12-29 | stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has an assertion failure in stbi__shiftsigned. |
CVE-2019-19777 | High | 8.8 | 2019-12-13 | stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has a heap-based buffer over-read in stbi__load_main. |
CVE-2018-16981 | High | 8.8 | 2018-09-12 | stb stb_image.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer overflow in the stbi__out_gif_code function. |