EUVD-2026-18091
GHSA-2487-c6w9-prxm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability has been found in Nothings stb up to 2.30. This issue affects the function stbi__gif_load_next in the library stb_image.h of the component GIF Decoder. Such manipulation leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Denial of service vulnerability in Nothings stb image library (stb_image.h) affecting GIF decoder function stbi__gif_load_next allows remote attackers to trigger application crashes through specially crafted GIF files. The vulnerability impacts stb versions up to 2.30, requires user interaction to open a malicious GIF, and has publicly available exploit code with no vendor patch available despite early disclosure.
Technical ContextAI
The vulnerability exists in the GIF decoder component (stbi__gif_load_next function) of stb_image.h, a widely-used single-header C image loading library. stb_image.h is a popular image processing library used across many applications for parsing multiple image formats including GIF, PNG, and JPEG. The root cause is classified as CWE-404 (uncontrolled resource consumption), indicating the GIF decoder likely fails to properly validate or limit resource allocation when processing malformed GIF structures, leading to memory exhaustion, buffer overrun, or infinite loops that crash the hosting application. The CPE cpe:2.3:a:nothings:stb:*:*:*:*:*:*:*:* indicates all stb library versions through 2.30 are affected.
RemediationAI
No vendor-released patch identified at time of analysis. The vendor was contacted early about this disclosure but did not respond. Organizations should monitor the official stb GitHub repository (https://github.com/nothings/stb) for security updates and consider either upgrading stb when a patched version is released or implementing input validation to reject malformed GIF files before passing them to stbi__gif_load_next. As a workaround, disable GIF decoding functionality if not required, or restrict image file processing to trusted sources only. Applications should add defensive error handling around image loading operations to gracefully handle decoder failures rather than allowing crashes.
stb_image.h (aka the stb image loader) 2.23 has a heap-based buffer over-read in stbi__tga_load, leading to Information
STB v2.27 was discovered to contain an integer shift of invalid size in the component stbi__jpeg_decode_block_prog_ac. R
Buffer overflow vulnerability in function stbi__extend_receive in stb_image.h in stb 2.26 via a crafted JPEG file. Rated
Out-of-bounds write in Nothings stb library up to version 1.22 allows remote attackers to corrupt memory and potentially
Resource exhaustion in Nothings stb library versions up to 1.22 allows unauthenticated remote attackers to cause denial
Out-of-bounds read in Nothings stb library up to version 1.26 allows remote attackers to trigger information disclosure
Double free vulnerability in Nothings stb library (up to version 2.30) in the multi-frame GIF file handler function stbi
Same weakness CWE-404 – Improper Resource Shutdown or Release
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Fixed |
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP4 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.3 | Fixed |
| openSUSE Leap 15.4 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today