CVE-2026-102805 PUBLISHED

Nothings stb Image Encoding stb_image_write.h stbi_write_tga_core integer overflow

Assigner: VulDB
Reserved: 29.09.2026 Published: 30.09.2026 Updated: 30.09.2026

A flaw has been found in Nothings stb up to 1.16. This affects the function stbi_write_png_to_mem/stbi_write_jpg_core/stbi_write_tga_core in the library stb_image_write.h of the component Image Encoding. Executing a manipulation can lead to integer overflow. The attack can be executed remotely. The exploit has been published and may be used.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CVSS Score: 6.9

Product Status

Vendor Nothings
Product stb
Versions
  • Version 1.0 is affected
  • Version 1.1 is affected
  • Version 1.2 is affected
  • Version 1.3 is affected
  • Version 1.4 is affected
  • Version 1.5 is affected
  • Version 1.6 is affected
  • Version 1.7 is affected
  • Version 1.8 is affected
  • Version 1.9 is affected
  • Version 1.10 is affected
  • Version 1.11 is affected
  • Version 1.12 is affected
  • Version 1.13 is affected
  • Version 1.14 is affected
  • Version 1.15 is affected
  • Version 1.16 is affected

Credits

  • JerryGW (VulDB User) reporter

References

Problem Types

  • Integer Overflow CWE
  • Numeric Error CWE