CVE-2026-5317
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
A security flaw has been discovered in Nothings stb up to 1.22, affecting the start_decoder function in stb_vorbis.c. The manipulation results in an out-of-bounds write. The exploit has been released to the public and may be used for remote attacks.
Risk Assessment
A remote attacker could exploit the out-of-bounds write to potentially execute code or cause a crash. The public exploit increases the risk of rapid exploitation.
Recommendation
Update stb to a version later than 1.22 or apply the vendor patch. Until then, avoid processing untrusted audio files with stb_vorbis.
Other vulnerabilities in stb
See all- CVE-2026-102805Medium
A flaw was found in Nothings stb up to version 1.16 affecting the stbi_write_png_to_mem, stbi_write_jpg_core, and stbi_write_tga_core functions (stb_image_write.h) in the Image Encoding component. Manipulation leads to an integer overflow. The attack can be executed remotely, and the exploit is publicly available.
- CVE-2026-102804Medium
A vulnerability was detected in Nothings stb up to version 2c980bb59875b0d32144a71867fbdebb2f77cd20 affecting the hexwave_init function (stb_hexwave.h). Manipulation of the width/oversample arguments results in an integer overflow. Remote exploitation is possible, and the exploit is now public.
- CVE-2026-5315Medium
A vulnerability was found in the stb library (stb_truetype.h) up to version 1.26, in the stbtt__buf_get8 function handling TTF files. Manipulation can lead to an out-of-bounds read. The attack can be executed remotely and the exploit has been publicly disclosed.
- CVE-2026-5314Medium
A vulnerability in the stb library (stb_truetype.h) up to version 1.26 causes an out-of-bounds read in stbtt_InitFont_internal when processing TTF files. The flaw can be exploited remotely and a public exploit exists.
- CVE-2026-5313Medium
In the stb library (stb_image.h) up to version 2.30, the stbi__gif_load_next function in the GIF decoder component allows denial of service via crafted input. The vulnerability can be exploited remotely and the exploit has been publicly disclosed.
Original NVD description (English source)
A security flaw has been discovered in Nothings stb up to 1.22. This affects the function start_decoder of the file stb_vorbis.c. The manipulation results in out-of-bounds write. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS