An integer overflow vulnerability exists in the Nothings stb library up to version 1.16 within the image encoding functions stbi_write_png_to_mem, stbi_write_jpg_core, and stbi_write_tga_core in stb_image_write.h. This flaw can be triggered remotely by manipulating input to these functions, potentially leading to memory corruption or other impacts associated with integer overflow. Exploit code for this vulnerability has been published, indicating potential risk for exploitation. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality and availability, with limited impact on integrity.

Successful exploitation of this integer overflow vulnerability could allow remote attackers to cause memory corruption or other unintended behavior in applications using the affected stb image encoding functions. The impact is rated medium severity with a CVSS score of 6.9, reflecting limited but notable risk. There are no reports of active exploitation in the wild at this time.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider avoiding use of the affected functions with untrusted input or apply other application-level mitigations to prevent triggering the vulnerability.