CVE-2026-5316: nothings stb Uncontrolled Resource Consumption
Vulnerability summary
CVE-2026-5316 is a medium (CVSS 6.5) Uncontrolled Resource Consumption vulnerability in nothings stb. EPSS estimates a 0.72% chance of exploitation in the next 30 days, higher than 52.9% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 02-04-2026PublishedVulnerability first disclosed.
- 02-04-2026Last modifiedVulnerability information updated.
Description
A vulnerability was identified in Nothings stb up to 1.22. The impacted element is the function setup_free of the file stb_vorbis.c. The manipulation leads to allocation of resources. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS metrics
10 scores · 4 sources · 4 versions- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
- NVDNIST2.1LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDiffers
- CVE.orgCNA4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:X/RC:RDiffers
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- NVDNIST5.0MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
EPSS trend
Probability
0.72%
Chance of exploitation in the next 30 days
Percentile
53%
Versus all other CVEs
30-day change
+0.28 pp
From 0.44% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundCc7F70Bba08C1A455D9933E97B8B57C1
Maturity: poc
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
Nothings2 products
- stb1.0 | 1.1 | 1.2 | 1.3 | 1.4 | 1.5 | 1.6 | 1.7 | 1.8 | 1.9 | 1.10 | 1.11 | 1.12 | 1.13 | 1.14 | 1.15 | 1.16 | 1.17 | 1.18 | 1.19 | 1.20 | 1.21 | 1.22
- stb_vorbis.c≤ 1.22
Debian1 product
- libstbAll versions (No fix recorded)
Ubuntu1 product
- libstbAll versions (No fix recorded)
3 vendors · 4 products
