Log in Start free

Vulnerability · Published Mar 31, 2026 · Assigned by VulDB

CVE-2026-5185Nothings stb_image Multi-frame GIF File stb_image.h stbi__gif_load_next heap-based overflow

Medium 5.3

In plain English

A medium-severity heap buffer overflow in stb_image from Nothings. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.2%top 95.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in Nothings stb_image up to 2.30. This affects the function stbi__gif_load_next of the file stb_image.h of the component Multi-frame GIF File Handler. The manipulation results in heap-based buffer overflow. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libstbno fix listedDEBIAN-CVE-2026-5185
Debian:13libstbno fix listedDEBIAN-CVE-2026-5185
Debian:14libstbno fix listedDEBIAN-CVE-2026-5185
Ubuntu:22.04:LTSlibstbno fix listedUBUNTU-CVE-2026-5185
Ubuntu:24.04:LTSlibstbno fix listedUBUNTU-CVE-2026-5185
Ubuntu:25.10libstbno fix listedUBUNTU-CVE-2026-5185
Ubuntu:26.04:LTSlibstbno fix listedUBUNTU-CVE-2026-5185
Ubuntu:26.10libstbno fix listedUBUNTU-CVE-2026-5185

Affected products (as reported)

VendorProductVersions
Nothings stb_image 2.02.12.22.32.42.52.62.7

Weakness: CWE-122, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References