Stb
by Nothings
Source repositories
CVEs (43)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-6623 | Hig | 0.57 | 8.8 | 0.01 | Jan 8, 2020 | stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_get_index. | ||
| CVE-2020-6622 | Hig | 0.57 | 8.8 | 0.01 | Jan 8, 2020 | stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_peek8. | ||
| CVE-2020-6621 | Hig | 0.57 | 8.8 | 0.01 | Jan 8, 2020 | stb stb_truetype.h through 1.22 has a heap-based buffer over-read in ttUSHORT. | ||
| CVE-2020-6618 | Hig | 0.57 | 8.8 | 0.01 | Jan 8, 2020 | stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__find_table. | ||
| CVE-2020-6617 | Hig | 0.57 | 8.8 | 0.01 | Jan 8, 2020 | stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_int. | ||
| CVE-2018-16981 | Hig | 0.57 | 8.8 | 0.02 | Sep 12, 2018 | stb stb_image.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer overflow in the stbi__out_gif_code function. | ||
| CVE-2018-1000050 | Hig | 0.57 | 8.8 | 0.02 | Feb 9, 2018 | Sean Barrett stb_vorbis version 1.12 and earlier contains a Buffer Overflow vulnerability in All vorbis decoding paths. that can result in memory corruption, denial of service, comprised execution of host program. This attack appear to be exploitable via Victim must open a… | ||
| CVE-2026-89266 | Hig | 0.53 | 8.2 | 0.01 | Sep 12, 2026 | stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook multiplicands allocation size is truncated from size_t to int. Attackers can craft a malicious Ogg Vorbis file with large entries and dimensions values to trigger out-of-bounds writes,… | ||
| CVE-2021-37789 | Hig | 0.53 | 8.1 | 0.01 | Nov 2, 2022 | stb_image.h 2.27 has a heap-based buffer over in stbi__jpeg_load, leading to Information Disclosure or Denial of Service. | ||
| CVE-2022-25514 | Hig | 0.49 | 7.5 | 0.01 | Mar 17, 2022 | stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttUSHORT() at stb_truetype.h. NOTE: Third party has disputed stating that the source code has also a disclaimer that it should only be used with trusted input. | ||
| CVE-2023-45666 | Hig | 0.48 | 7.3 | 0.01 | Oct 21, 2023 | stb_image is a single file MIT licensed library for processing images. It may look like `stbi__load_gif_main` doesn’t give guarantees about the content of output value `*delays` upon failure. Although it sets `*delays` to zero at the beginning, it doesn’t do it in case the… | ||
| CVE-2023-45664 | Hig | 0.48 | 7.3 | 0.01 | Oct 21, 2023 | stb_image is a single file MIT licensed library for processing images. A crafted image file can trigger `stbi__load_gif_main_outofmem` attempt to double-free the out variable. This happens in `stbi__load_gif_main` because when the `layers * stride` value is zero the behavior is… | ||
| CVE-2023-45681 | Hig | 0.47 | 7.3 | 0.01 | Oct 21, 2023 | stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory write past an allocated heap buffer in `start_decoder`. The root cause is a potential integer overflow in `sizeof(char*) * (f->comment_list_length)` which may make… | ||
| CVE-2023-45679 | Hig | 0.47 | 7.3 | 0.01 | Oct 21, 2023 | stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory allocation failure in `start_decoder`. In that case the function returns early, but some of the pointers in `f->comment_list` are left initialized and later… | ||
| CVE-2023-45677 | Hig | 0.47 | 7.3 | 0.01 | Oct 21, 2023 | stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[len] = (char)'\0';`. The root cause is that if `len` read in `start_decoder` is a negative number and `setup_malloc` successfully… | ||
| CVE-2023-45676 | Hig | 0.47 | 7.3 | 0.01 | Oct 21, 2023 | stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[i] = get8_packet(f);`. The root cause is an integer overflow in `setup_malloc`. A sufficiently large value in the variable `sz`… | ||
| CVE-2026-18497 | Hig | 0.46 | 7.1 | 0.00 | Aug 7, 2026 | A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbtt__GetGlyphShapeTT() function within the nothings stb_truetype.h library when parsing malformed… | ||
| CVE-2023-45678 | Med | 0.42 | 6.5 | 0.01 | Oct 21, 2023 | stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of buffer write in `start_decoder` because at maximum `m->submaps` can be 16 but `submap_floor` and `submap_residue` are declared as arrays of 15 elements. This issue… | ||
| CVE-2023-45675 | Med | 0.42 | 6.5 | 0.01 | Oct 21, 2023 | stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[len] = (char)'\0';`. The root cause is that if the len read in `start_decoder` is `-1` and `len + 1` becomes 0 when passed to… | ||
| CVE-2023-45662 | Med | 0.42 | 6.5 | 0.01 | Oct 21, 2023 | stb_image is a single file MIT licensed library for processing images. When `stbi_set_flip_vertically_on_load` is set to `TRUE` and `req_comp` is set to a number that doesn’t match the real number of components per pixel, the library attempts to flip the image vertically. A… |
- risk 0.57cvss 8.8epss 0.01
stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_get_index.
- risk 0.57cvss 8.8epss 0.01
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_peek8.
- risk 0.57cvss 8.8epss 0.01
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in ttUSHORT.
- risk 0.57cvss 8.8epss 0.01
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__find_table.
- risk 0.57cvss 8.8epss 0.01
stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_int.
- risk 0.57cvss 8.8epss 0.02
stb stb_image.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer overflow in the stbi__out_gif_code function.
- risk 0.57cvss 8.8epss 0.02
Sean Barrett stb_vorbis version 1.12 and earlier contains a Buffer Overflow vulnerability in All vorbis decoding paths. that can result in memory corruption, denial of service, comprised execution of host program. This attack appear to be exploitable via Victim must open a…
- risk 0.53cvss 8.2epss 0.01
stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook multiplicands allocation size is truncated from size_t to int. Attackers can craft a malicious Ogg Vorbis file with large entries and dimensions values to trigger out-of-bounds writes,…
- risk 0.53cvss 8.1epss 0.01
stb_image.h 2.27 has a heap-based buffer over in stbi__jpeg_load, leading to Information Disclosure or Denial of Service.
- risk 0.49cvss 7.5epss 0.01
stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttUSHORT() at stb_truetype.h. NOTE: Third party has disputed stating that the source code has also a disclaimer that it should only be used with trusted input.
- risk 0.48cvss 7.3epss 0.01
stb_image is a single file MIT licensed library for processing images. It may look like `stbi__load_gif_main` doesn’t give guarantees about the content of output value `*delays` upon failure. Although it sets `*delays` to zero at the beginning, it doesn’t do it in case the…
- risk 0.48cvss 7.3epss 0.01
stb_image is a single file MIT licensed library for processing images. A crafted image file can trigger `stbi__load_gif_main_outofmem` attempt to double-free the out variable. This happens in `stbi__load_gif_main` because when the `layers * stride` value is zero the behavior is…
- risk 0.47cvss 7.3epss 0.01
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory write past an allocated heap buffer in `start_decoder`. The root cause is a potential integer overflow in `sizeof(char*) * (f->comment_list_length)` which may make…
- risk 0.47cvss 7.3epss 0.01
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory allocation failure in `start_decoder`. In that case the function returns early, but some of the pointers in `f->comment_list` are left initialized and later…
- risk 0.47cvss 7.3epss 0.01
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[len] = (char)'\0';`. The root cause is that if `len` read in `start_decoder` is a negative number and `setup_malloc` successfully…
- risk 0.47cvss 7.3epss 0.01
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[i] = get8_packet(f);`. The root cause is an integer overflow in `setup_malloc`. A sufficiently large value in the variable `sz`…
- risk 0.46cvss 7.1epss 0.00
A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbtt__GetGlyphShapeTT() function within the nothings stb_truetype.h library when parsing malformed…
- risk 0.42cvss 6.5epss 0.01
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of buffer write in `start_decoder` because at maximum `m->submaps` can be 16 but `submap_floor` and `submap_residue` are declared as arrays of 15 elements. This issue…
- risk 0.42cvss 6.5epss 0.01
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[len] = (char)'\0';`. The root cause is that if the len read in `start_decoder` is `-1` and `len + 1` becomes 0 when passed to…
- risk 0.42cvss 6.5epss 0.01
stb_image is a single file MIT licensed library for processing images. When `stbi_set_flip_vertically_on_load` is set to `TRUE` and `req_comp` is set to a number that doesn’t match the real number of components per pixel, the library attempts to flip the image vertically. A…
Page 1 of 3