Stb
by Nothings
Source repositories
CVEs (40)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-6623 | Hig | 0.57 | 8.8 | 0.01 | Jan 8, 2020 | stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_get_index. | ||
| CVE-2020-6622 | Hig | 0.57 | 8.8 | 0.01 | Jan 8, 2020 | stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_peek8. | ||
| CVE-2020-6621 | Hig | 0.57 | 8.8 | 0.01 | Jan 8, 2020 | stb stb_truetype.h through 1.22 has a heap-based buffer over-read in ttUSHORT. | ||
| CVE-2020-6618 | Hig | 0.57 | 8.8 | 0.01 | Jan 8, 2020 | stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__find_table. | ||
| CVE-2020-6617 | Hig | 0.57 | 8.8 | 0.01 | Jan 8, 2020 | stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_int. | ||
| CVE-2018-16981 | Hig | 0.57 | 8.8 | 0.02 | Sep 12, 2018 | stb stb_image.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer overflow in the stbi__out_gif_code function. | ||
| CVE-2021-37789 | Hig | 0.53 | 8.1 | 0.01 | Nov 2, 2022 | stb_image.h 2.27 has a heap-based buffer over in stbi__jpeg_load, leading to Information Disclosure or Denial of Service. | ||
| CVE-2022-25514 | Hig | 0.49 | 7.5 | 0.01 | Mar 17, 2022 | stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttUSHORT() at stb_truetype.h. NOTE: Third party has disputed stating that the source code has also a disclaimer that it should only be used with trusted input. | ||
| CVE-2023-45666 | Hig | 0.48 | 7.3 | 0.01 | Oct 21, 2023 | stb_image is a single file MIT licensed library for processing images. It may look like `stbi__load_gif_main` doesn’t give guarantees about the content of output value `*delays` upon failure. Although it sets `*delays` to zero at the beginning, it doesn’t do it in case the… | ||
| CVE-2023-45664 | Hig | 0.48 | 7.3 | 0.01 | Oct 21, 2023 | stb_image is a single file MIT licensed library for processing images. A crafted image file can trigger `stbi__load_gif_main_outofmem` attempt to double-free the out variable. This happens in `stbi__load_gif_main` because when the `layers * stride` value is zero the behavior is… | ||
| CVE-2023-45681 | Hig | 0.47 | 7.3 | 0.01 | Oct 21, 2023 | stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory write past an allocated heap buffer in `start_decoder`. The root cause is a potential integer overflow in `sizeof(char*) * (f->comment_list_length)` which may make… | ||
| CVE-2023-45679 | Hig | 0.47 | 7.3 | 0.01 | Oct 21, 2023 | stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory allocation failure in `start_decoder`. In that case the function returns early, but some of the pointers in `f->comment_list` are left initialized and later… | ||
| CVE-2023-45677 | Hig | 0.47 | 7.3 | 0.01 | Oct 21, 2023 | stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[len] = (char)'\0';`. The root cause is that if `len` read in `start_decoder` is a negative number and `setup_malloc` successfully… | ||
| CVE-2023-45676 | Hig | 0.47 | 7.3 | 0.01 | Oct 21, 2023 | stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[i] = get8_packet(f);`. The root cause is an integer overflow in `setup_malloc`. A sufficiently large value in the variable `sz`… | ||
| CVE-2026-18497 | Hig | 0.46 | 7.1 | 0.00 | Aug 7, 2026 | A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbtt__GetGlyphShapeTT() function within the nothings stb_truetype.h library when parsing malformed… | ||
| CVE-2023-45678 | Med | 0.42 | 6.5 | 0.01 | Oct 21, 2023 | stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of buffer write in `start_decoder` because at maximum `m->submaps` can be 16 but `submap_floor` and `submap_residue` are declared as arrays of 15 elements. This issue… | ||
| CVE-2023-45675 | Med | 0.42 | 6.5 | 0.01 | Oct 21, 2023 | stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[len] = (char)'\0';`. The root cause is that if the len read in `start_decoder` is `-1` and `len + 1` becomes 0 when passed to… | ||
| CVE-2023-45662 | Med | 0.42 | 6.5 | 0.01 | Oct 21, 2023 | stb_image is a single file MIT licensed library for processing images. When `stbi_set_flip_vertically_on_load` is set to `TRUE` and `req_comp` is set to a number that doesn’t match the real number of components per pixel, the library attempts to flip the image vertically. A… | ||
| CVE-2023-45661 | Med | 0.42 | 6.5 | 0.01 | Oct 21, 2023 | stb_image is a single file MIT licensed library for processing images. A crafted image file may trigger out of bounds memcpy read in `stbi__gif_load_next`. This happens because two_back points to a memory address lower than the start of the buffer out. This issue may be used to… | ||
| CVE-2022-25516 | Med | 0.42 | 6.5 | 0.01 | Mar 17, 2022 | stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function stbtt__find_table at stb_truetype.h. NOTE: Third party has disputed stating that the source code has also a disclaimer that it should only be used with trusted input. |
- risk 0.57cvss 8.8epss 0.01
stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_get_index.
- risk 0.57cvss 8.8epss 0.01
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_peek8.
- risk 0.57cvss 8.8epss 0.01
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in ttUSHORT.
- risk 0.57cvss 8.8epss 0.01
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__find_table.
- risk 0.57cvss 8.8epss 0.01
stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_int.
- risk 0.57cvss 8.8epss 0.02
stb stb_image.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer overflow in the stbi__out_gif_code function.
- risk 0.53cvss 8.1epss 0.01
stb_image.h 2.27 has a heap-based buffer over in stbi__jpeg_load, leading to Information Disclosure or Denial of Service.
- risk 0.49cvss 7.5epss 0.01
stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttUSHORT() at stb_truetype.h. NOTE: Third party has disputed stating that the source code has also a disclaimer that it should only be used with trusted input.
- risk 0.48cvss 7.3epss 0.01
stb_image is a single file MIT licensed library for processing images. It may look like `stbi__load_gif_main` doesn’t give guarantees about the content of output value `*delays` upon failure. Although it sets `*delays` to zero at the beginning, it doesn’t do it in case the…
- risk 0.48cvss 7.3epss 0.01
stb_image is a single file MIT licensed library for processing images. A crafted image file can trigger `stbi__load_gif_main_outofmem` attempt to double-free the out variable. This happens in `stbi__load_gif_main` because when the `layers * stride` value is zero the behavior is…
- risk 0.47cvss 7.3epss 0.01
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory write past an allocated heap buffer in `start_decoder`. The root cause is a potential integer overflow in `sizeof(char*) * (f->comment_list_length)` which may make…
- risk 0.47cvss 7.3epss 0.01
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory allocation failure in `start_decoder`. In that case the function returns early, but some of the pointers in `f->comment_list` are left initialized and later…
- risk 0.47cvss 7.3epss 0.01
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[len] = (char)'\0';`. The root cause is that if `len` read in `start_decoder` is a negative number and `setup_malloc` successfully…
- risk 0.47cvss 7.3epss 0.01
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[i] = get8_packet(f);`. The root cause is an integer overflow in `setup_malloc`. A sufficiently large value in the variable `sz`…
- risk 0.46cvss 7.1epss 0.00
A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbtt__GetGlyphShapeTT() function within the nothings stb_truetype.h library when parsing malformed…
- risk 0.42cvss 6.5epss 0.01
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of buffer write in `start_decoder` because at maximum `m->submaps` can be 16 but `submap_floor` and `submap_residue` are declared as arrays of 15 elements. This issue…
- risk 0.42cvss 6.5epss 0.01
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[len] = (char)'\0';`. The root cause is that if the len read in `start_decoder` is `-1` and `len + 1` becomes 0 when passed to…
- risk 0.42cvss 6.5epss 0.01
stb_image is a single file MIT licensed library for processing images. When `stbi_set_flip_vertically_on_load` is set to `TRUE` and `req_comp` is set to a number that doesn’t match the real number of components per pixel, the library attempts to flip the image vertically. A…
- risk 0.42cvss 6.5epss 0.01
stb_image is a single file MIT licensed library for processing images. A crafted image file may trigger out of bounds memcpy read in `stbi__gif_load_next`. This happens because two_back points to a memory address lower than the start of the buffer out. This issue may be used to…
- risk 0.42cvss 6.5epss 0.01
stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function stbtt__find_table at stb_truetype.h. NOTE: Third party has disputed stating that the source code has also a disclaimer that it should only be used with trusted input.
Page 1 of 2