Nothings vulnerabilities
48 vulnerabilities
Known vulnerabilities in Nothings products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 6 products.
Products
6- Stb26 vulnerabilities
- Stb Image.H19 vulnerabilities
- Stb Truetype.H12 vulnerabilities
- Stb Vorbis.C11 vulnerabilities
- Stb Image1 vulnerabilities
- Stb Vorbis1 vulnerabilities
CVE-2018-16981debianlibstb+14
EPSS score1.59%
stb stb_image.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer overflow in the stbi__out_gif_code function.CVE-2021-42715debianlibstb+4EPSS score1.30%
An issue was discovered in stb stb_image.h 1.33 through 2.27. The HDR loader parsed truncated end-of-file RLE scanlines as an infinite sequence of zero-length runs. An attacker could potentially have caused denial of service in applications using stb_image by submitting crafted HDR files.CVE-2021-42716debianlibstb+5EPSS score1.46%
An issue was discovered in stb stb_image.h 2.27. The PNM loader incorrectly interpreted 16-bit PGM files as 8-bit when converting to RGBA, leading to a buffer overflow when later reinterpreting the result as a 16-bit buffer. An attacker could potentially have crashed a service using stb_image, or read up to 1024 bytes of non-consecutive heap data without control over the read location.CVE-2025-3406debianlibstb+3EPSS score0.58%
A vulnerability was found in Nothings stb up to f056911. It has been classified as problematic. Affected is the function stbhw_build_tileset_from_image of the component Header Array Handler. The manipulation of the argument w leads to out-of-bounds read. It is possible to launch the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.CVE-2025-3408debianlibstb+3EPSS score0.50%
A vulnerability was found in Nothings stb up to f056911. It has been rated as critical. Affected by this issue is the function stb_dupreplace. The manipulation leads to integer overflow. The attack may be launched remotely. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.CVE-2025-3407debianlibstb+3EPSS score0.47%
A vulnerability was found in Nothings stb up to f056911. It has been declared as critical. Affected by this vulnerability is the function stbhw_build_tileset_from_image. The manipulation of the argument h_count/v_count leads to out-of-bounds read. The attack can be launched remotely. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.CVE-2025-3409debianlibstb+3EPSS score0.52%
A vulnerability classified as critical has been found in Nothings stb up to f056911. This affects the function stb_include_string. The manipulation of the argument path_to_includes leads to stack-based buffer overflow. It is possible to initiate the attack remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.CVE-2020-6621ubuntulibstb+1EPSS score1.14%
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in ttUSHORT.CVE-2020-6618ubuntulibstb+1EPSS score1.14%
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__find_table.CVE-2020-6622ubuntulibstb+1EPSS score1.45%
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_peek8.CVE-2020-6619ubuntulibstb+1EPSS score1.14%
stb stb_truetype.h through 1.22 has an assertion failure in stbtt__buf_seek.CVE-2020-6623ubuntulibstb+1EPSS score1.45%
stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_get_index.CVE-2020-6620ubuntulibstb+1EPSS score1.14%
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_get8.CVE-2020-6617ubuntulibstb+1EPSS score1.14%
stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_int.CVE-2022-25516nothingsstb_truetype.hEPSS score0.94%
stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function stbtt__find_table at stb_truetype.h. NOTE: Third party has disputed stating that the source code has also a disclaimer that it should only be used with trusted input.CVE-2022-25514nothingsstb_truetype.hEPSS score1.04%
stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttUSHORT() at stb_truetype.h. NOTE: Third party has disputed stating that the source code has also a disclaimer that it should only be used with trusted input.CVE-2022-25515nothingsstb_truetype.hEPSS score0.94%
stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttULONG() at stb_truetype.h. NOTE: Third party has disputed stating that the source code has also a disclaimer that it should only be used with trusted input.CVE-2022-28041debianlibstb+7EPSS score2.09%
stb_image.h v2.27 was discovered to contain an integer overflow via the function stbi__jpeg_decode_block_prog_dc. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.CVE-2022-28042debianlibstb+4EPSS score1.61%
stb_image.h v2.27 was discovered to contain an heap-based use-after-free via the function stbi__jpeg_huff_decode.CVE-2019-19777debianlibsixel+3EPSS score1.39%
stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has a heap-based buffer over-read in stbi__load_main.