Threats affecting pkg:github/nothings/stb

CVE-2026-102805 is an integer overflow vulnerability in the Nothings stb library affecting image encoding functions. It impacts versions 1.0 through 1.16 and can be triggered remotely without authentication or user interaction. The vulnerability has a medium severity with a CVSS 4.0 base score of 6.9. Exploit code is publicly available, but no active exploitation has been confirmed.

CVE-2026-5317 is a medium severity vulnerability in Nothings stb library versions up to 1.22. It involves an out-of-bounds write in the start_decoder function within the stb_vorbis.c file. The flaw can be triggered remotely and requires user interaction. Although an exploit has been publicly released, there is no vendor response or official patch available at this time.

CVE-2026-5316 is a medium severity vulnerability in Nothings stb library versions up to 1.22. It involves improper allocation of resources in the setup_free function within the stb_vorbis.c file. The vulnerability can be exploited remotely and requires no privileges or user interaction. Although an exploit is publicly available, there are no known exploits observed in the wild. The vendor has not responded to disclosure requests, and no patch or official fix is currently available.

CVE-2026-5315 is a medium severity vulnerability in the Nothings stb library up to version 1.26. It involves an out-of-bounds read in the function stbtt__buf_get8 within the stb_truetype.h component responsible for handling TTF files. This vulnerability can be triggered remotely by manipulating input, potentially leading to unauthorized memory reads. The vulnerability has been publicly disclosed, but the vendor has not responded or provided a patch. No known exploits are currently observed in the wild.

CVE-2026-5314 is an out-of-bounds read vulnerability in the stb_truetype.h library of Nothings stb up to version 1.26. It affects the function stbtt_InitFont_internal within the TTF File Handler component. The vulnerability can be triggered remotely by manipulating input, potentially leading to reading memory outside intended bounds. The vendor has not responded to the disclosure, and no patch or fix is currently available. The CVSS 4.0 base score is 5.3, indicating a medium severity level. Exploit code has been made public, but no known exploits in the wild have been reported.