stb_image_write EUVD-2026-89536

Exploitation requires an application that calls stb_image_write.h's stbi_write_png_to_mem, stbi_write_jpg_core, or stbi_write_tga_core (stb up to version 1.16) with attacker-influenced image parameters - specifically width, height, or channel/component counts that make the internal size computation overflow. The limiting factor is reachability: the vulnerable code path is an image ENCODER, so the attacker must be able to control the dimensions/pixel-buffer sizing passed to the write routine (e.g., an upload/convert/re-encode feature), rather than merely reaching a network port. No authentication is modeled in the vector (PR:N) and no user interaction (UI:N), but real-world exposure depends on whether the host application feeds untrusted sizing into these functions.

This is a genuine but modest-severity issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with impacts limited to VI:L/VA:L yields 6.9 (Medium), and the E:P (Proof-of-Concept) exploit-maturity flag aligns with the confirmed public exploit. There is NO EPSS score and NO CISA KEV listing provided, so there is no evidence of active or automated exploitation - publicly available exploit code exists, but that is a distinct signal from active exploitation. The low integrity/availability sub-scores are appropriate: a CWE-190 integer overflow in image ENCODING functions typically produces an undersized allocation and heap out-of-bounds write, tending toward crashes/memory corruption rather than reliable RCE, and confidentiality is rated N. The AV:N 'remotely executed' framing is optimistic and vendor-typical (VulDB): these are encoder entry points, so exploitation requires an application to pass attacker-influenced image dimensions/components into stbi_write_* - reachability is application-dependent, not a direct network listener. Net: a real but lower-priority hardening issue rather than an emergency; treat the AV:N as 'reachable via untrusted input in some apps,' not 'unauthenticated internet-facing service.'

An application uses stb_image_write.h to re-encode user-supplied images (e.g., a thumbnail/conversion service) and passes attacker-controlled width, height, or component counts into stbi_write_png_to_mem/stbi_write_jpg_core/stbi_write_tga_core. Crafted dimensions overflow the size arithmetic, causing an undersized buffer allocation followed by an out-of-bounds heap write, corrupting memory or crashing the process. Public exploit/PoC material is referenced in the vendor's stb issue #1964.