Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
26 results
Mar 31, 2026A security flaw has been discovered in Nothings stb_image up to 2.30.CVE-2026-5185 · Other software · Nothings · reported by VulDBLow 1.9
A security flaw has been discovered in Nothings stb_image up to 2.30. This affects the function stbi__gif_load_next of the file stb_image.h of the component Multi-frame GIF File Handler. The manipulation results in heap-based buffer overflow. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- stb_image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023Double Free vulnerability in Nothings Stb Image.h v.2.28 allows a remote attacker to cause a denial of service via a crafted file to the stbi_load_gif_main funcCVE-2023-43281 · Other software · Nothings · reported by MITREMedium 6.5
Double Free vulnerability in Nothings Stb Image.h v.2.28 allows a remote attacker to cause a denial of service via a crafted file to the stbi_load_gif_main function.
- Product
- STB Image.h
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 20, 2023stb_image is a single file MIT licensed library for processing images.CVE-2023-45667 · Other software · nothings · reported by GitHubMedium 5.3
stb_image is a single file MIT licensed library for processing images. If `stbi__load_gif_main` in `stbi_load_gif_from_memory` fails it returns a null pointer and may keep the `z` variable uninitialized. In case the caller also sets the flip vertically flag, it continues and calls `stbi__vertical_flip_slices` with the null pointer result value and the uninitialized `z` value. This may result in a program crash.
- Product
- stb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2023stb_image is a single file MIT licensed library for processing images.CVE-2023-45666 · Other software · nothings · reported by GitHubHigh 7.3
stb_image is a single file MIT licensed library for processing images. It may look like `stbi__load_gif_main` doesn’t give guarantees about the content of output value `*delays` upon failure. Although it sets `*delays` to zero at the beginning, it doesn’t do it in case the image is not recognized as GIF and a call to `stbi__load_gif_main_outofmem` only frees possibly allocated memory in `*delays` without resetting it to zero. Thus it would be fair to say the caller of `stbi__load_gif_main` is responsible to free the allocated memory in `*delays` only if `stbi__load_gif_main` returns a non null value. However at the same time the function may return null value, but fail to free the memory in `*delays` if internally `stbi__convert_format` is called and fails. Thus the issue may lead to a memory leak if the caller chooses to free `delays` only when `stbi__load_gif_main` didn’t fail or to a double-free if the `delays` is always freed
- Product
- stb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2023stb_image is a single file MIT licensed library for processing images.CVE-2023-45664 · Other software · nothings · reported by GitHubHigh 7.3
stb_image is a single file MIT licensed library for processing images. A crafted image file can trigger `stbi__load_gif_main_outofmem` attempt to double-free the out variable. This happens in `stbi__load_gif_main` because when the `layers * stride` value is zero the behavior is implementation defined, but common that realloc frees the old memory and returns null pointer. Since it attempts to double-free the memory a few lines below the first “free”, the issue can be potentially exploited only in a multi-threaded environment. In the worst case this may lead to code execution.
- Product
- stb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Oct 20, 2023stb_image is a single file MIT licensed library for processing images.CVE-2023-45663 · Other software · nothings · reported by GitHubMedium 5.3
stb_image is a single file MIT licensed library for processing images. The stbi__getn function reads a specified number of bytes from context (typically a file) into the specified buffer. In case the file stream points to the end, it returns zero. There are two places where its return value is not checked: In the `stbi__hdr_load` function and in the `stbi__tga_load` function. The latter of the two is likely more exploitable as an attacker may also control the size of an uninitialized buffer.
- Product
- stb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2023stb_image is a single file MIT licensed library for processing images.CVE-2023-45662 · Other software · nothings · reported by GitHubMedium 6.5
stb_image is a single file MIT licensed library for processing images. When `stbi_set_flip_vertically_on_load` is set to `TRUE` and `req_comp` is set to a number that doesn’t match the real number of components per pixel, the library attempts to flip the image vertically. A crafted image file can trigger `memcpy` out-of-bounds read because `bytes_per_pixel` used to calculate `bytes_per_row` doesn’t match the real image array dimensions.
- Product
- stb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Oct 20, 2023stb_image is a single file MIT licensed library for processing images.CVE-2023-45661 · Other software · nothings · reported by GitHubMedium 6.5
stb_image is a single file MIT licensed library for processing images. A crafted image file may trigger out of bounds memcpy read in `stbi__gif_load_next`. This happens because two_back points to a memory address lower than the start of the buffer out. This issue may be used to leak internal memory allocation information.
- Product
- stb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023Nothings stb 2.28 was discovered to contain a Null Pointer Dereference via the function stbi__convert_format.CVE-2023-43898 · Other software · Nothings · reported by MITREMedium 5.5
Nothings stb 2.28 was discovered to contain a Null Pointer Dereference via the function stbi__convert_format. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted pic file.
- Product
- STB Image.h
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2022stb_image.h 2.27 has a heap-based buffer over in stbi__jpeg_load, leading to Information Disclosure or Denial of Service.CVE-2021-37789 · Other software · STB Project · reported by MITREHigh 8.1
stb_image.h 2.27 has a heap-based buffer over in stbi__jpeg_load, leading to Information Disclosure or Denial of Service.
- Product
- STB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
May 11, 2022There is an assertion failure error in stbi__jpeg_huff_decode, stb_image.h:1894 in libsixel img2sixel 1.8.6.CVE-2022-29977 · Other software · Saitoha · reported by MITREMedium 6.5
There is an assertion failure error in stbi__jpeg_huff_decode, stb_image.h:1894 in libsixel img2sixel 1.8.6. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted JPEG file.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2022stb_image.h v2.27 was discovered to contain an heap-based use-after-free via the function stbi__jpeg_huff_decode.CVE-2022-28042 · Other software · Nothings · reported by MITREHigh 8.8
stb_image.h v2.27 was discovered to contain an heap-based use-after-free via the function stbi__jpeg_huff_decode.
- Product
- STB Image.h
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2022stb_image.h v2.27 was discovered to contain an integer overflow via the function stbi__jpeg_decode_block_prog_dc.CVE-2022-28041 · Other software · Nothings · reported by MITREMedium 6.5
stb_image.h v2.27 was discovered to contain an integer overflow via the function stbi__jpeg_decode_block_prog_dc. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.
- Product
- STB Image.h
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2022stb_image.h (aka the stb image loader) 2.19, as used in libsixel and other products, has a reachable assertion in stbi__create_png_image_raw.CVE-2022-27938 · Other software · Libsixel · reported by MITREMedium 5.5
stb_image.h (aka the stb image loader) 2.19, as used in libsixel and other products, has a reachable assertion in stbi__create_png_image_raw.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2022In Libsixel prior to and including v1.10.3, a NULL pointer dereference in the stb_image.h component of libsixel allows attackers to cause a denial of service (DCVE-2021-45340 · Other software · Libsixel · reported by MITREMedium 6.5
In Libsixel prior to and including v1.10.3, a NULL pointer dereference in the stb_image.h component of libsixel allows attackers to cause a denial of service (DOS) via a crafted PICT file.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2021An issue was discovered in stb stb_image.h 2.27.CVE-2021-42716 · Other software · Nothings · reported by MITREHigh 7.1
An issue was discovered in stb stb_image.h 2.27. The PNM loader incorrectly interpreted 16-bit PGM files as 8-bit when converting to RGBA, leading to a buffer overflow when later reinterpreting the result as a 16-bit buffer. An attacker could potentially have crashed a service using stb_image, or read up to 1024 bytes of non-consecutive heap data without control over the read location.
- Product
- STB Image.h
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2021An issue was discovered in stb stb_image.h 1.33 through 2.27.CVE-2021-42715 · Other software · Nothings · reported by MITREMedium 5.5
An issue was discovered in stb stb_image.h 1.33 through 2.27. The HDR loader parsed truncated end-of-file RLE scanlines as an infinite sequence of zero-length runs. An attacker could potentially have caused denial of service in applications using stb_image by submitting crafted HDR files.
- Product
- STB Image.h
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2021Buffer overflow vulnerability in function stbi__extend_receive in stb_image.h in stb 2.26 via a crafted JPEG file.CVE-2021-28021 · Other software · STB Project · reported by MITREHigh 7.8
Buffer overflow vulnerability in function stbi__extend_receive in stb_image.h in stb 2.26 via a crafted JPEG file.
- Product
- STB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Sep 14, 2021An invalid read in the stb_image.h component of libsixel prior to v1.8.5 allows attackers to cause a denial of service (DOS) via a crafted PSD file.CVE-2020-21049 · Other software · Saitoha · reported by MITREMedium 6.5
An invalid read in the stb_image.h component of libsixel prior to v1.8.5 allows attackers to cause a denial of service (DOS) via a crafted PSD file.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitbucket.orggithub.com
Dec 29, 2019stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has an assertion failure in stbi__shiftsigned.CVE-2019-20056 · Other software · Nothings · reported by MITREMedium 6.5
stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has an assertion failure in stbi__shiftsigned.
- Product
- STB Image.h
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2019stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has a heap-based buffer over-read in stbi__load_main.CVE-2019-19777 · Other software · Nothings · reported by MITREHigh 8.8
stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has a heap-based buffer over-read in stbi__load_main.
- Product
- STB Image.h
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2019stb_image.h (aka the stb image loader) 2.23 has a heap-based buffer over-read in stbi__tga_load, leading to Information Disclosure or Denial of Service.CVE-2019-15058 · Other software · STB Project · reported by MITRECritical 9.1
stb_image.h (aka the stb image loader) 2.23 has a heap-based buffer over-read in stbi__tga_load, leading to Information Disclosure or Denial of Service.
- Product
- STB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orggithub.com
Nov 29, 2018There is a heap-based buffer over-read at stb_image_write.h (function: stbi_write_png_to_mem) in libsixel 1.8.2 that will cause a denial of service.CVE-2018-19759 · Other software · Saitoha · reported by MITREMedium 5.5
There is a heap-based buffer over-read at stb_image_write.h (function: stbi_write_png_to_mem) in libsixel 1.8.2 that will cause a denial of service.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Nov 29, 2018There is a heap-based buffer over-read at stb_image.h (function: stbi__tga_load) in libsixel 1.8.2 that will cause a denial of service.CVE-2018-19756 · Other software · Saitoha · reported by MITREMedium 5.5
There is a heap-based buffer over-read at stb_image.h (function: stbi__tga_load) in libsixel 1.8.2 that will cause a denial of service.
- Product
- Libsixel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Sep 12, 2018stb stb_image.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer overflow in the stbi__out_gif_code function.CVE-2018-16981 · Other software · Nothings · reported by MITREHigh 8.8
stb stb_image.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer overflow in the stbi__out_gif_code function.
- Product
- STB Image.h
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jul 9, 2018A heap-based buffer overflow exists in stbi__bmp_load_cont in stb_image.h in catimg 2.4.0.CVE-2018-13794 · Other software · Catimg Project · reported by MITRECritical 9.8
A heap-based buffer overflow exists in stbi__bmp_load_cont in stb_image.h in catimg 2.4.0.
- Product
- Catimg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.