Nothings stb Integer Overflow in Image/Audio Headers

Integer overflow in the hexwave_init() function of Nothings stb (stb_hexwave.h) corrupts allocation sizing when an application passes attacker-influenced width or oversample arguments during wave-table initialization. Exploitation is remote and unauthenticated at the library level and publicly available exploit code exists (no confirmed active exploitation), but the practical attack surface is limited: these are initialization parameters normally hardcoded by the developer, so exploitation requires an application that surfaces them to untrusted input. Impact is bounded to low integrity and availability loss, consistent with memory corruption or a crash rather than reliable code execution, and the project has not responded to the issue report, leaving no confirmed vendor patch.

Integer overflow in the image-encoding routines of nothings/stb (stb_image_write.h, stb through version 1.16) allows remote attackers who can influence image dimensions or channel counts passed to stbi_write_png_to_mem, stbi_write_jpg_core, or stbi_write_tga_core to corrupt memory or crash the encoding process. Publicly available exploit code exists (no CISA KEV entry, so active exploitation is not confirmed), and the flaw requires an application that feeds attacker-controlled sizing into the encoder rather than simple network reachability. The published CVSS 4.0 score of 6.9 overstates practical risk: an independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N with only low integrity and availability impact and no confidentiality impact - a genuine but modest-severity issue whose real exposure depends entirely on whether the host application passes untrusted dimensions to the write functions.