CVE catalog
CVE-2023-45664
libstb: CVE-2023-45664
- Severity
- Medium
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.93% · Oct 25, 2026
stb_image is a single file MIT licensed library for processing images. A crafted image file can trigger `stbi__load_gif_main_outofmem` attempt to double-free the out variable. This happens in `stbi__load_gif_main` because when the `layers * stride` value is zero the behavior is implementation defined, but common that realloc frees the old memory and returns null pointer. Since it attempts to double-free the memory a few lines below the first “free”, the issue can be potentially exploited only in a multi-threaded environment. In the worst case this may lead to code execution.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | libstb | sid | 0.0~git20250907.fede005+ds-1 | vulnerable |
| Debian | libstb | forky | 0.0~git20250907.fede005+ds-1 | vulnerable |
| Debian | libstb | trixie | 0.0~git20241109.5c20573+ds-1 | vulnerable |
| Debian | libstb | bookworm | 0.0~git20220908.8b5f1f3+ds-1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | libstb | source | sid | (unfixed) | not yet assigned | Not reported | [1054911] |
| Debian | libstb | source | forky | (unfixed) | not yet assigned | Not reported | [1054911] |
| Debian | libstb | source | trixie | (unfixed) | not yet assigned | Not reported | [1054911] |
| Debian | libstb | source | bookworm | (unfixed) | not yet assigned | Not reported | [1054911] |
Notes
[trixie] libstb: Minor issue, revisit when fixed upstream [bookworm] libstb: Minor issue, revisit when fixed upstream
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.