Stb CVE-2026-5186

Q: What is the CVSS score of CVE-2026-5186?

CVE-2026-5186 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17340 LOW

Double Free (CWE-415)

2026-03-31 VulDB

GHSA-593x-hf83-hmrv

Information Disclosure Stb Nothings

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SUSE

4.3 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

4.8 (MEDIUM) 1.9 (LOW)

EUVD ID Assigned

Mar 31, 2026 - 08:00 euvd

EUVD-2026-17340

Analysis Generated

Mar 31, 2026 - 08:00 vuln.today

CVE Published

Mar 31, 2026 - 07:30 nvd

MEDIUM 4.8

DescriptionCVE.org

A weakness has been identified in Nothings stb up to 2.30. This impacts the function stbi__load_gif_main of the file stb_image.h of the component Multi-frame GIF File Handler. This manipulation causes double free. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Double free vulnerability in Nothings stb library (up to version 2.30) in the multi-frame GIF file handler function stbi__load_gif_main allows local authenticated attackers to cause information disclosure and memory corruption. Public exploit code is available. The vendor did not respond to early disclosure notification, leaving affected users without an official patch.

Technical ContextAI

The vulnerability exists in stb_image.h, a popular single-header image loading library used across embedded systems, game engines, and applications for lightweight image processing. The weakness is classified as CWE-415 (Double Free), a memory safety defect where the same memory address is freed twice during processing of multi-frame GIF files. This occurs in the stbi__load_gif_main function, which handles parsing and loading of animated GIF data structures. Local authenticated attackers with file system or process access can craft malicious GIF files to trigger the double free condition, leading to heap corruption, information disclosure, and potential code execution depending on heap state and memory layout.

RemediationAI

Update to stb library version 2.31 or later if released by the vendor, or apply a patched version available from the official repository. No vendor-released patch version is confirmed from available data; users should monitor the Nothings stb GitHub repository for security updates and pull requests addressing double free in stbi__load_gif_main. As a temporary mitigation, disable GIF file loading functionality if not required by the application, implement file type validation to reject untrusted GIF files, and use sandboxing or privilege separation to limit impact of memory corruption. Vendors embedding stb_image.h should conduct code review of the stbi__load_gif_main function and consider applying upstream fixes from community sources if official patches are unavailable.