Skip to content

Product

debian/libstb vulnerabilities

54 published CVES affecting debian/libstb, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
54
Critical
3
High
23
Medium
26
Low
0
Unscored
2
CISA KEV
0

Latest debian/libstb CVEs

Newest publication first · page 1 of 3

  2. CVE-2026-102804 Nothings stb stb_hexwave.h hexwave_init integer overflow

    Published
    MediumCVSS 6.9 EPSS 0.35%

    A vulnerability was detected in Nothings stb up to 2c980bb59875b0d32144a71867fbdebb2f77cd20. The impacted element is the function hexwave_init in the library stb_hexwave.h. Performing a manipulation of the argument width/oversample results in integer overflow. Remote exploitation...

  7. CVE-2026-5317 Nothings stb stb_vorbis.c start_decoder out-of-bounds write

    Published
    MediumCVSS 5.3 EPSS 0.43%

    A security flaw has been discovered in Nothings stb up to 1.22. This affects the function start_decoder of the file stb_vorbis.c. The manipulation results in out-of-bounds write. The attack may be performed from remote. The exploit has been released to the public and may be used...

  8. CVE-2026-5316 Nothings stb stb_vorbis.c setup_free allocation of resources

    Published
    MediumCVSS 5.3 EPSS 0.45%

    A vulnerability was identified in Nothings stb up to 1.22. The impacted element is the function setup_free of the file stb_vorbis.c. The manipulation leads to allocation of resources. The attack is possible to be carried out remotely. The exploit is publicly available and might b...

  9. CVE-2026-5315 Nothings stb TTF File stb_truetype.h stbtt__buf_get8 out-of-bounds

    Published
    MediumCVSS 5.3 EPSS 0.52%

    A vulnerability was determined in Nothings stb up to 1.26. The affected element is the function stbtt__buf_get8 in the library stb_truetype.h of the component TTF File Handler. Executing a manipulation can lead to out-of-bounds read. The attack can be executed remotely. The explo...

  15. CVE-2025-3409 Nothings stb stb_include_string stack-based overflow

    Published
    MediumCVSS 5.3 EPSS 0.53%

    A vulnerability classified as critical has been found in Nothings stb up to f056911. This affects the function stb_include_string. The manipulation of the argument path_to_includes leads to stack-based buffer overflow. It is possible to initiate the attack remotely. This product...

  16. CVE-2025-3408 Nothings stb stb_dupreplace integer overflow

    Published
    MediumCVSS 5.3 EPSS 0.51%

    A vulnerability was found in Nothings stb up to f056911. It has been rated as critical. Affected by this issue is the function stb_dupreplace. The manipulation leads to integer overflow. The attack may be launched remotely. Continious delivery with rolling releases is used by thi...

  17. CVE-2025-3407 Nothings stb stbhw_build_tileset_from_image out-of-bounds

    Published
    MediumCVSS 5.3 EPSS 0.48%

    A vulnerability was found in Nothings stb up to f056911. It has been declared as critical. Affected by this vulnerability is the function stbhw_build_tileset_from_image. The manipulation of the argument h_count/v_count leads to out-of-bounds read. The attack can be launched remot...

  19. CVE-2023-47212 A heap-based buffer overflow vulnerability exists in the comment functionality of stb _vorbis.c v1.22. A specially crafted .ogg file can lead to an out-of-bounds write. An attacker can provide a malic...

    Published
    CriticalCVSS 9.8 EPSS 1.4%

    A heap-based buffer overflow vulnerability exists in the comment functionality of stb _vorbis.c v1.22. A specially crafted .ogg file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.

  20. CVE-2023-45682 Wild address read in vorbis_decode_packet_rest in stb_vorbis

    Published
    HighCVSS 7.1 EPSS 0.58%

    stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds read in DECODE macro when var is negative. As it can be seen in the definition of DECODE_RAW a negative var is a valid value. This issue may be used to leak...

  21. CVE-2023-45681 Out of bounds heap buffer write in stb_vorbis

    Published
    HighCVSS 7.8 EPSS 0.51%

    stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory write past an allocated heap buffer in start_decoder. The root cause is a potential integer overflow in sizeof(char*) * (f->comment_list_length) which may make setu...

  22. CVE-2023-45680 Null pointer dereference in vorbis_deinit in stb_vorbis

    Published
    MediumCVSS 5.5 EPSS 0.55%

    stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory allocation failure in start_decoder. In that case the function returns early, the f->comment_list is set to NULL, but f->comment_list_length is not reset. Later in...

  24. CVE-2023-45678 Off-by-one heap buffer write in start_decoder in stb_vorbis

    Published
    HighCVSS 7.8 EPSS 0.74%

    stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of buffer write in start_decoder because at maximum m->submaps can be 16 but submap_floor and submap_residue are declared as arrays of 15 elements. This issue may lead...

  25. CVE-2023-45677 Heap buffer out of bounds write in start_decoder in stb_vorbis

    Published
    HighCVSS 7.8 EPSS 0.52%

    stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in f->vendor[len] = (char)'\0';. The root cause is that if len read in start_decoder is a negative number and setup_malloc successfully allocates memor...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.