EUVD-2026-17337
GHSA-ccf6-mw22-wphc
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 3.1 score of 5.3 reflects moderate risk with an attack vector of Local (AV:L), low complexity (AC:L), and low privilege requirements (PR:L), indicating an authenticated local user can trigger the vulnerability without special conditions. The EPSS exploitation probability marker (E:P) combined with publicly available exploit code (POC=YES) elevates practical risk. However, the requirement for local access and authenticated privilege substantially restricts the threat surface compared to network-based vulnerabilities. SSVC framework analysis: exploitation is proven (public POC), automatable at moderate complexity (GIF file crafting), but technical impact is limited (C:L, I:L, A:L)-memory corruption rather than guaranteed code execution. This is a real concern for applications that process untrusted GIF files in multi-user systems or containers where privilege boundaries matter, but not an immediate critical priority for single-user or air-gapped deployments. |
| Exploit ScenarioDerived | A local authenticated user on a shared system crafts a malicious multi-frame GIF file and uploads it to an application using stb_image for processing (e.g., an image converter service or media gallery). When the application calls stbi__gif_load_next to parse the GIF frames, the overflow corrupts heap memory, potentially crashing the application or, in carefully constructed payloads, achieving limited information disclosure or integrity compromise. The attack requires direct file access to the vulnerable parsing function, making it most practical in environments where multiple users share a system or where untrusted GIF inputs are processed server-side. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 31, 2026
Heap-based buffer overflow in Nothings stb_image library up to version 2.30 in the stbi__gif_load_next function allows local authenticated attackers to cause memory corruption with limited confidentiality, integrity, and availability impact. Public exploit code is available; however, the vulnerability requires local access and authenticated privilege level, significantly limiting real-world exploitation scope. The vendor has not responded to early disclosure attempts.
RemediationAI
Upgrade stb_image to a version after 2.30 once the vendor releases a patched version. At the time of this analysis, the vendor has not confirmed patch availability or a specific fix version; monitor the official stb_image repository and VulDB references for release notices. As an interim workaround, disable GIF multi-frame processing in applications, restrict file loading to trusted sources, or implement external GIF validation before passing to stb_image. Developers embedding stb_image should review their use case and privilege model to determine if local authenticated access is realistically possible in their threat model.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
stb_image is a popular single-header C library for image loading and processing. The vulnerability exists in the multi-frame GIF file handler component, specifically in the stbi__gif_load_next function within stb_image.h. The root cause is classified as CWE-122 (Heap-based Buffer Overflow), indicating improper bounds checking when processing GIF frame data during sequential frame loading. The heap corruption occurs when parsing specially crafted multi-frame GIF files, allowing memory writes beyond allocated buffer boundaries. This is a memory safety issue inherent to C-based image parsing without robust input validation.
Know when Stb Image gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A security flaw has been discovered in Nothings stb_image up to 2.30. This affects the function stbi__gif_load_next of the file stb_image.h of the component Multi-frame GIF File Handler. The manipulation results in heap-based buffer overflow. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Related Vulnerabilities in Nothings stb_image Buffer Overflow Flaws
View all 2Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allVendor StatusVendor
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 0.0~git20200713.b42009b+ds-1 | - |
| bullseye (security) | vulnerable | 0.0~git20200713.b42009b+ds-1+deb11u1 | - |
| bookworm | vulnerable | 0.0~git20220908.8b5f1f3+ds-1 | - |
| trixie | vulnerable | 0.0~git20241109.5c20573+ds-1 | - |
| forky, sid | vulnerable | 0.0~git20250907.fede005+ds-1 | - |
| (unstable) | fixed | (unfixed) | - |
Exploit-DB