CVE-2026-102804
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A vulnerability was detected in Nothings stb up to version 2c980bb59875b0d32144a71867fbdebb2f77cd20 affecting the hexwave_init function (stb_hexwave.h). Manipulation of the width/oversample arguments results in an integer overflow. Remote exploitation is possible, and the exploit is now public.
Risk Assessment
A remote attacker can exploit the integer overflow to cause crashes or potentially achieve code execution. The public exploit increases the risk of exploitation.
Recommendation
Update the stb library to the latest version or implement validation of the width/oversample arguments before calling hexwave_init. Monitor systems for unusual behavior.
Other vulnerabilities in stb
See all- CVE-2026-102805Medium
A flaw was found in Nothings stb up to version 1.16 affecting the stbi_write_png_to_mem, stbi_write_jpg_core, and stbi_write_tga_core functions (stb_image_write.h) in the Image Encoding component. Manipulation leads to an integer overflow. The attack can be executed remotely, and the exploit is publicly available.
- CVE-2026-5317Medium
A security flaw has been discovered in Nothings stb up to 1.22, affecting the start_decoder function in stb_vorbis.c. The manipulation results in an out-of-bounds write. The exploit has been released to the public and may be used for remote attacks.
- CVE-2026-5315Medium
A vulnerability was found in the stb library (stb_truetype.h) up to version 1.26, in the stbtt__buf_get8 function handling TTF files. Manipulation can lead to an out-of-bounds read. The attack can be executed remotely and the exploit has been publicly disclosed.
- CVE-2026-5314Medium
A vulnerability in the stb library (stb_truetype.h) up to version 1.26 causes an out-of-bounds read in stbtt_InitFont_internal when processing TTF files. The flaw can be exploited remotely and a public exploit exists.
- CVE-2026-5313Medium
In the stb library (stb_image.h) up to version 2.30, the stbi__gif_load_next function in the GIF decoder component allows denial of service via crafted input. The vulnerability can be exploited remotely and the exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability was detected in Nothings stb up to 2c980bb59875b0d32144a71867fbdebb2f77cd20. The impacted element is the function hexwave_init in the library stb_hexwave.h. Performing a manipulation of the argument width/oversample results in integer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS