CVE-2026-79516
MediumCVSS 4.0Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
The stbsp_vsnprintf function in nothings stb (commit 31c1ad3) has an out-of-bounds read that can be exploited via crafted input, causing a denial of service.
Risk Assessment
An attacker can crash applications using this function, leading to service unavailability. This requires providing specially crafted input.
Recommendation
Update the nothings stb library to a patched version or avoid using the vulnerable function with untrusted data.
Other vulnerabilities in nothings stb
See all- CVE-2026-79515Medium
The stbtt_GetGlyphShape component in nothings stb (commit 31c1ad3) has an out-of-bounds read that can be exploited via a crafted TTF file, causing a denial of service.
- CVE-2026-5316Medium
A vulnerability was identified in Nothings stb up to 1.22 in the setup_free function of stb_vorbis.c, leading to allocation of resources. The attack can be carried out remotely, and a publicly available exploit might be used. The vendor was contacted early but did not respond.
Original NVD description (English source)
An out-of-bounds read in the stbsp_vsnprintf function (stb_sprintf.h) of nothings stb commit 31c1ad3 allows attackers to cause a Denial of Service (DoS) via sending a crafted input.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS