Log in Start free

Vulnerability · Published Apr 8, 2025 · Assigned by VulDB

CVE-2025-3408Nothings stb stb_dupreplace integer overflow

Medium 6.3

In plain English

A medium-severity integer overflow in stb from Nothings. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.5%top 56.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in Nothings stb up to f056911. It has been rated as critical. Affected by this issue is the function stb_dupreplace. The manipulation leads to integer overflow. The attack may be launched remotely. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libstbno fix listedDEBIAN-CVE-2025-3408
Debian:13libstbno fix listedDEBIAN-CVE-2025-3408
Debian:14libstbno fix listedDEBIAN-CVE-2025-3408
Ubuntu:22.04:LTSlibstbno fix listedUBUNTU-CVE-2025-3408
Ubuntu:24.04:LTSlibstbno fix listedUBUNTU-CVE-2025-3408
Ubuntu:25.10libstbno fix listedUBUNTU-CVE-2025-3408
Ubuntu:26.04:LTSlibstbno fix listedUBUNTU-CVE-2025-3408
Ubuntu:26.10libstbno fix listedUBUNTU-CVE-2025-3408

Affected products (as reported)

VendorProductVersions
Nothings stb f056911

Weakness: CWE-190, CWE-189 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

References