EUVD-2026-89535
GHSA-x842-766r-cjq8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach app exposing hexwave_init params
-
DeliverySupply crafted width/oversample values
-
ExploitTrigger integer overflow in allocation
-
ExecutionCause undersized buffer and OOB access
-
ImpactCorrupt memory or crash process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an application that integrates stb_hexwave.h AND passes attacker-influenced values into the width or oversample arguments of hexwave_init(); the overflow occurs during initialization allocation sizing. Limiting factors: these are library initialization parameters typically hardcoded or set by the developer rather than derived from untrusted input, so despite PR:N/UI:N the 'remote' path only exists in applications that surface these parameters externally. Impact is bounded (VI:L/VA:L, no confidentiality) - consistent with memory corruption/crash rather than reliable code execution - and no vendor patch is confirmed available. |
| Impact | Signals are mixed and point to a moderate, not urgent, priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) is theoretically favorable to an attacker - network, low complexity, no privileges, no user interaction - but the impact metrics are the real story: VC:N/VI:L/VA:L and no subsequent-system impact, meaning at most limited integrity and availability effects (consistent with an integer overflow leading to under-allocation/possible OOB rather than clean code execution). SSVC-style exploitation status is Proof-of-Concept (E:P) and a POC is publicly hosted, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or automated exploitation - publicly available exploit code exists but that is distinct from in-the-wild use. The most important caveat NVD/CVSS does not capture: stb_hexwave.h is a LIBRARY function, and hexwave_init's width/oversample are initialization parameters normally set by the host application, not by remote input - so the 'Remote exploitation is possible' claim and AV:N are only realistic when a consuming application exposes those parameters to attacker control, which is not the common case. Verify reachability against the specific integrating application before prioritizing. |
| Exploit ScenarioDerived | An application that embeds stb_hexwave.h and passes externally-controlled values into hexwave_init's width or oversample arguments processes a crafted input; the multiplication overflows, producing an undersized allocation and subsequent out-of-bounds access that corrupts memory or crashes the process. A public proof-of-concept (poc_hexwave.c) demonstrates the overflow, but weaponization to code execution is not established and impact is rated limited (VI:L/VA:L). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Integer overflow in the hexwave_init() function of Nothings stb (stb_hexwave.h) corrupts allocation sizing when an application passes attacker-influenced width or oversample arguments during wave-table initialization. Exploitation is remote and unauthenticated at the library level and publicly available exploit code exists (no confirmed active exploitation), but the practical attack surface is limited: these are initialization parameters normally hardcoded by the developer, so exploitation requires an application that surfaces them to untrusted input. Impact is bounded to low integrity and availability loss, consistent with memory corruption or a crash rather than reliable code execution, and the project has not responded to the issue report, leaving no confirmed vendor patch.
RemediationAI
No vendor-released patch is identified at time of analysis: the stb maintainer was notified via issue 1961 and has not responded, so there is no tagged fixed commit to upgrade to - track https://github.com/nothings/stb/ and issue 1961 for an eventual upstream fix and pin your vendored copy once one lands. Until then, the most effective compensating control is to never pass untrusted data into hexwave_init(): validate and clamp width and oversample to small, expected constants before the call, and reject values outside the range your application legitimately uses - this carries no functional cost for applications that already hardcode these parameters, which is the normal usage pattern. Where a parameter must be sourced externally, enforce explicit upper bounds (and reject negative or zero values) at the API boundary and, if the audio path is reachable over a network or from user-supplied files, restrict that path to trusted callers or disable the feature entirely - the trade-off being loss of the waveform-generation capability. Applications that cannot guarantee safe inputs should patch the vendored header locally to add overflow-checked size computation and allocation-size guards around the hexwave_init() table sizing, accepting the maintenance burden of diverging from upstream. Because exploitation requires write access to a buffer during initialization, deploying compiler/hardening options already in wide use (stack canaries, FORTIFY_SOURCE, ASan in testing builds) raises the chance the corruption is caught as a crash rather than silently exploited, though it does not remove the defect.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Nothings stb is a widely embedded collection of single-header C/C++ libraries; stb_hexwave.h provides band-limited waveform (BLEP) table generation used in audio synthesis. The hexwave_init() routine computes sizes for internal tables from the caller-supplied width and oversample parameters before allocating and filling buffers. Because those arithmetic operations are performed without adequate overflow checking (CWE-190), crafted or unexpectedly large values wrap the computed size, producing an undersized allocation that is subsequently written past its bounds - the reported impact class spans integer overflow and buffer overflow. Any project that compiles in stb_hexwave.h and feeds externally controllable values into those two arguments inherits the flaw; the CPE cpe:2.3:a:nothings:stb:*:*:*:*:*:*:*:* treats the whole stb distribution as affected since the library ships as source headers rather than versioned binaries. The assessor's CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) confirms the unauthenticated remote vector and a bounded, availability/integrity-only outcome.
Know when Stb gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Mirrors vendor impact (limited integrity/availability, no confidentiality); AV:N/PR:N kept for consistency though real reachability depends on the host app feeding attacker-controlled init parameters.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was detected in Nothings stb up to 2c980bb59875b0d32144a71867fbdebb2f77cd20. The impacted element is the function hexwave_init in the library stb_hexwave.h. Performing a manipulation of the argument width/oversample results in integer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Related Vulnerabilities in Nothings stb Integer Overflow in Image/Audio Headers
View all 2stb_image.h (aka the stb image loader) 2.23 has a heap-based buffer over-read in stbi__tga_load, leading to Information
STB v2.27 was discovered to contain an integer shift of invalid size in the component stbi__jpeg_decode_block_prog_ac. R
Buffer overflow vulnerability in function stbi__extend_receive in stb_image.h in stb 2.26 via a crafted JPEG file. Rated
Out-of-bounds write in Nothings stb library up to version 1.22 allows remote attackers to corrupt memory and potentially
Resource exhaustion in Nothings stb library versions up to 1.22 allows unauthenticated remote attackers to cause denial
Out-of-bounds read in Nothings stb library up to version 1.26 allows remote attackers to trigger information disclosure
Denial of service vulnerability in Nothings stb image library (stb_image.h) affecting GIF decoder function stbi__gif_loa
Double free vulnerability in Nothings stb library (up to version 2.30) in the multi-frame GIF file handler function stbi
Exploit-DB