CVE-2026-5313

A flaw was found in Nothings stb up to version 1.16 affecting the stbi_write_png_to_mem, stbi_write_jpg_core, and stbi_write_tga_core functions (stb_image_write.h) in the Image Encoding component. Manipulation leads to an integer overflow. The attack can be executed remotely, and the exploit is publicly available.

A vulnerability was detected in Nothings stb up to version 2c980bb59875b0d32144a71867fbdebb2f77cd20 affecting the hexwave_init function (stb_hexwave.h). Manipulation of the width/oversample arguments results in an integer overflow. Remote exploitation is possible, and the exploit is now public.

A security flaw has been discovered in Nothings stb up to 1.22, affecting the start_decoder function in stb_vorbis.c. The manipulation results in an out-of-bounds write. The exploit has been released to the public and may be used for remote attacks.

A vulnerability was found in the stb library (stb_truetype.h) up to version 1.26, in the stbtt__buf_get8 function handling TTF files. Manipulation can lead to an out-of-bounds read. The attack can be executed remotely and the exploit has been publicly disclosed.

A vulnerability in the stb library (stb_truetype.h) up to version 1.26 causes an out-of-bounds read in stbtt_InitFont_internal when processing TTF files. The flaw can be exploited remotely and a public exploit exists.