This vulnerability affects the Nothings stb library up to commit 2c980bb59875b0d32144a71867fbdebb2f77cd20. The issue is located in the hexwave_init function of stb_hexwave.h, where improper handling of the width and oversample parameters can cause an integer overflow. This overflow can be triggered remotely, and exploit code is publicly available. Despite early notification via an issue report, the project has not responded or provided a patch.

Successful exploitation of this integer overflow could allow an attacker to cause unexpected behavior in the affected function, potentially leading to denial of service or other impacts depending on how the overflow is leveraged. Remote exploitation is possible without privileges or user interaction. However, no confirmed active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, avoid processing untrusted input that could manipulate the width or oversample arguments in hexwave_init.