EUVD-2026-18110Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 4.3 score with network attack vector and low complexity reflects genuine but limited severity: availability impact only, no confidentiality or integrity breach. However, multiple risk signals strengthen the priority. The CVSS environmental score includes E:P (Proof of Concept Exists), confirming publicly available exploits lower the barrier to weaponization. KEV status is not confirmed, so this is not yet confirmed as actively exploited by CISA, but real-world risk remains elevated because: (1) the attack is unauthenticated (PR:N) and requires only user interaction (UI:R-a user processing an audio file), (2) stb's widespread embedding means vulnerable instances are numerous, and (3) the exploit is immediately usable. The RC:R (Reproducible) rating and POC availability suggest this transitions from theoretical to practical risk quickly. This is a legitimate priority for defenders using stb_vorbis, particularly in media players, web audio implementations, and game engines, even though CVSS alone appears modest. |
| Exploit ScenarioDerived | An attacker crafts a malicious Ogg Vorbis audio file with specially formed stream headers that trigger excessive resource allocation in the setup_free function. The attacker distributes this file through a messaging platform, media sharing site, or embedding it in a webpage. When a victim's application (containing embedded stb_vorbis) attempts to decode or process the file-whether for playback, transcoding, or analysis-the vulnerable setup_free function allocates resources without proper limits, consuming CPU or memory and causing the application to hang or crash. The low barrier to exploitation (unauthenticated, single-file attack, publicly available POC) means this can be launched at scale against deployed applications. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 02, 2026
Resource exhaustion in Nothings stb library versions up to 1.22 allows unauthenticated remote attackers to cause denial of service through the setup_free function in stb_vorbis.c when processing malformed audio data. The vulnerability has publicly available exploit code and a low CVSS score of 4.3 reflecting limited impact, but represents a real availability risk in applications embedding this widely-used header-only graphics and audio library.
RemediationAI
Upgrade Nothings stb to version 1.23 or later, which should contain fixes for the resource allocation flaw in setup_free. Applications must rebuild and redeploy with the updated header file. If immediate patching is infeasible, implement input validation and rate limiting on audio file uploads and processing to reduce the likelihood of triggering excessive resource allocation from malformed Vorbis streams. Monitor for CPU and memory spikes during audio decoding operations. Detailed technical analysis and vendor communication history are available through VulDB at https://vuldb.com/vuln/354648.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The stb library is a popular collection of single-header C libraries for graphics, audio, and utility functions. The vulnerability resides in stb_vorbis.c, specifically the setup_free function which handles memory deallocation during Ogg Vorbis audio decoding. CWE-770 (Allocation of Resources Without Limits or Throttling) indicates the flaw allows an attacker to trigger excessive resource allocation-likely through crafted Vorbis stream headers or metadata that cause the parser to allocate disproportionate memory or CPU cycles during the setup phase. Since stb is header-only and embedded directly into applications, every application using stb_vorbis.c for audio decoding inherits this vulnerability.
Know when Stb gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was identified in Nothings stb up to 1.22. The impacted element is the function setup_free of the file stb_vorbis.c. The manipulation leads to allocation of resources. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Nothings stb Library Memory Safety Flaws
View all 3stb_image.h (aka the stb image loader) 2.23 has a heap-based buffer over-read in stbi__tga_load, leading to Information
STB v2.27 was discovered to contain an integer shift of invalid size in the component stbi__jpeg_decode_block_prog_ac. R
Buffer overflow vulnerability in function stbi__extend_receive in stb_image.h in stb 2.26 via a crafted JPEG file. Rated
Integer overflow in the image-encoding routines of nothings/stb (stb_image_write.h, stb through version 1.16) allows rem
Integer overflow in the hexwave_init() function of Nothings stb (stb_hexwave.h) corrupts allocation sizing when an appli
Out-of-bounds read in Nothings stb library up to version 1.26 allows remote attackers to trigger information disclosure
Denial of service vulnerability in Nothings stb image library (stb_image.h) affecting GIF decoder function stbi__gif_loa
Double free vulnerability in Nothings stb library (up to version 2.30) in the multi-frame GIF file handler function stbi
Same technique Denial Of Service
View allVendor StatusVendor
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 0.0~git20200713.b42009b+ds-1 | - |
| bullseye (security) | vulnerable | 0.0~git20200713.b42009b+ds-1+deb11u1 | - |
| bookworm | vulnerable | 0.0~git20220908.8b5f1f3+ds-1 | - |
| trixie | vulnerable | 0.0~git20241109.5c20573+ds-1 | - |
| forky, sid | vulnerable | 0.0~git20250907.fede005+ds-1 | - |
| (unstable) | fixed | (unfixed) | - |
Exploit-DB