EUVD-2026-18110Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability was identified in Nothings stb up to 1.22. The impacted element is the function setup_free of the file stb_vorbis.c. The manipulation leads to allocation of resources. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Resource exhaustion in Nothings stb library versions up to 1.22 allows unauthenticated remote attackers to cause denial of service through the setup_free function in stb_vorbis.c when processing malformed audio data. The vulnerability has publicly available exploit code and a low CVSS score of 4.3 reflecting limited impact, but represents a real availability risk in applications embedding this widely-used header-only graphics and audio library.
Technical ContextAI
The stb library is a popular collection of single-header C libraries for graphics, audio, and utility functions. The vulnerability resides in stb_vorbis.c, specifically the setup_free function which handles memory deallocation during Ogg Vorbis audio decoding. CWE-770 (Allocation of Resources Without Limits or Throttling) indicates the flaw allows an attacker to trigger excessive resource allocation-likely through crafted Vorbis stream headers or metadata that cause the parser to allocate disproportionate memory or CPU cycles during the setup phase. Since stb is header-only and embedded directly into applications, every application using stb_vorbis.c for audio decoding inherits this vulnerability.
RemediationAI
Upgrade Nothings stb to version 1.23 or later, which should contain fixes for the resource allocation flaw in setup_free. Applications must rebuild and redeploy with the updated header file. If immediate patching is infeasible, implement input validation and rate limiting on audio file uploads and processing to reduce the likelihood of triggering excessive resource allocation from malformed Vorbis streams. Monitor for CPU and memory spikes during audio decoding operations. Detailed technical analysis and vendor communication history are available through VulDB at https://vuldb.com/vuln/354648.
stb_image.h (aka the stb image loader) 2.23 has a heap-based buffer over-read in stbi__tga_load, leading to Information
STB v2.27 was discovered to contain an integer shift of invalid size in the component stbi__jpeg_decode_block_prog_ac. R
Buffer overflow vulnerability in function stbi__extend_receive in stb_image.h in stb 2.26 via a crafted JPEG file. Rated
Out-of-bounds write in Nothings stb library up to version 1.22 allows remote attackers to corrupt memory and potentially
Out-of-bounds read in Nothings stb library up to version 1.26 allows remote attackers to trigger information disclosure
Denial of service vulnerability in Nothings stb image library (stb_image.h) affecting GIF decoder function stbi__gif_loa
Double free vulnerability in Nothings stb library (up to version 2.30) in the multi-frame GIF file handler function stbi
Same technique Denial Of Service
View allVendor StatusVendor
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 0.0~git20200713.b42009b+ds-1 | - |
| bullseye (security) | vulnerable | 0.0~git20200713.b42009b+ds-1+deb11u1 | - |
| bookworm | vulnerable | 0.0~git20220908.8b5f1f3+ds-1 | - |
| trixie | vulnerable | 0.0~git20241109.5c20573+ds-1 | - |
| forky, sid | vulnerable | 0.0~git20250907.fede005+ds-1 | - |
| (unstable) | fixed | (unfixed) | - |
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today