nothings stb vulnerabilities

The stbsp_vsnprintf function in nothings stb (commit 31c1ad3) has an out-of-bounds read that can be exploited via crafted input, causing a denial of service.

The stbtt_GetGlyphShape component in nothings stb (commit 31c1ad3) has an out-of-bounds read that can be exploited via a crafted TTF file, causing a denial of service.

A vulnerability was identified in Nothings stb up to 1.22 in the setup_free function of stb_vorbis.c, leading to allocation of resources. The attack can be carried out remotely, and a publicly available exploit might be used. The vendor was contacted early but did not respond.