CVE catalog

CVE-2026-102805

A flaw has been found in Nothings stb up to 1.16. This affects the function stbi_write_png_to_mem/stbi_write_jpg_core/stbi_write_tga_core in the library stb_image_write.h of the component Image Encodi

[CVE catalog]

Severity
Medium · CVSS 5.5CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.35% · Oct 27, 2026

A flaw has been found in Nothings stb up to 1.16. This affects the function stbi_write_png_to_mem/stbi_write_jpg_core/stbi_write_tga_core in the library stb_image_write.h of the component Image Encoding. Executing a manipulation can lead to integer overflow. The attack can be executed remotely. The exploit has been published and may be used.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibstbsid0.0~git20250907.fede005+ds-1vulnerable
Debianlibstbforky0.0~git20250907.fede005+ds-1vulnerable
Debianlibstbtrixie0.0~git20241109.5c20573+ds-1vulnerable
Debianlibstbbookworm0.0~git20220908.8b5f1f3+ds-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibstbsourcesid(unfixed)not yet assignedNot reported[1150800]
Debianlibstbsourceforky(unfixed)not yet assignedNot reported[1150800]
Debianlibstbsourcetrixie(unfixed)not yet assignedNot reported[1150800]
Debianlibstbsourcebookworm(unfixed)not yet assignedNot reported[1150800]

[Debian bug #1150800]

Notes

[trixie] libstb: Minor issue, revisit when fixed upstream [bookworm] libstb: Minor issue, revisit when fixed upstream

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libstb0]Affected

    Source package: [libstb]

    Details (2)

    • 0.0~git20220908.8b5f1f3+ds-1 · amd64 · bookworm

      Affected

      nvd · libstb · debian · bookworm; nvd · libstb · debian · 12

    • 0.0~git20220908.8b5f1f3+ds-1 · arm64 · bookworm

      Affected

      nvd · libstb · debian · bookworm; nvd · libstb · debian · 12

  • [libstb-dev]Affected

    Source package: [libstb]

    Details (2)

    • 0.0~git20220908.8b5f1f3+ds-1 · amd64 · bookworm

      Affected

      nvd · libstb · debian · bookworm; nvd · libstb · debian · 12

    • 0.0~git20220908.8b5f1f3+ds-1 · arm64 · bookworm

      Affected

      nvd · libstb · debian · bookworm; nvd · libstb · debian · 12

[Debian 13 (Trixie)]

  • [libstb0t64]Affected

    Source package: [libstb]

    Details (2)

    • 0.0~git20241109.5c20573+ds-1 · amd64 · trixie

      Affected

      nvd · libstb · debian · 13

    • 0.0~git20241109.5c20573+ds-1 · arm64 · trixie

      Affected

      nvd · libstb · debian · 13

  • [libstb-dev]Affected

    Source package: [libstb]

    Details (2)

    • 0.0~git20241109.5c20573+ds-1 · amd64 · trixie

      Affected

      nvd · libstb · debian · 13

    • 0.0~git20241109.5c20573+ds-1 · arm64 · trixie

      Affected

      nvd · libstb · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]