CVE-2026-5316
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A vulnerability was identified in Nothings stb up to 1.22 in the setup_free function of stb_vorbis.c, leading to allocation of resources. The attack can be carried out remotely, and a publicly available exploit might be used. The vendor was contacted early but did not respond.
Risk Assessment
Applications using stb_vorbis to process untrusted audio data may be exposed to remote attacks causing resource exhaustion or instability.
Recommendation
Update stb to a patched version or restrict processing of untrusted Vorbis files; monitor for an official fix.
Other vulnerabilities in Nothings stb
See all- CVE-2026-79516Medium
The stbsp_vsnprintf function in nothings stb (commit 31c1ad3) has an out-of-bounds read that can be exploited via crafted input, causing a denial of service.
- CVE-2026-79515Medium
The stbtt_GetGlyphShape component in nothings stb (commit 31c1ad3) has an out-of-bounds read that can be exploited via a crafted TTF file, causing a denial of service.
Original NVD description (English source)
A vulnerability was identified in Nothings stb up to 1.22. The impacted element is the function setup_free of the file stb_vorbis.c. The manipulation leads to allocation of resources. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS