Nothings Stb Image H
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Nothings Stb Image H.
By the Year
In 2025 there have been 0 vulnerabilities in Nothings Stb Image H. Stb Image H did not have any published security vulnerabilities last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2025 | 0 | 0.00 |
| 2024 | 0 | 0.00 |
| 2023 | 8 | 7.35 |
| 2022 | 2 | 7.65 |
| 2021 | 2 | 6.30 |
| 2020 | 0 | 0.00 |
| 2019 | 2 | 7.65 |
| 2018 | 1 | 8.80 |
It may take a day or so for new Stb Image H vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Nothings Stb Image H Security Vulnerabilities
Double Free vulnerability in Nothings Stb Image.h v.2.28
CVE-2023-43281
6.5 - Medium
- October 25, 2023
Double Free vulnerability in Nothings Stb Image.h v.2.28 allows a remote attacker to cause a denial of service via a crafted file to the stbi_load_gif_main function.
Double-free
stb_image is a single file MIT licensed library for processing images
CVE-2023-45667
7.5 - High
- October 21, 2023
stb_image is a single file MIT licensed library for processing images. If `stbi__load_gif_main` in `stbi_load_gif_from_memory` fails it returns a null pointer and may keep the `z` variable uninitialized. In case the caller also sets the flip vertically flag, it continues and calls `stbi__vertical_flip_slices` with the null pointer result value and the uninitialized `z` value. This may result in a program crash.
NULL Pointer Dereference
stb_image is a single file MIT licensed library for processing images
CVE-2023-45666
9.8 - Critical
- October 21, 2023
stb_image is a single file MIT licensed library for processing images. It may look like `stbi__load_gif_main` doesnt give guarantees about the content of output value `*delays` upon failure. Although it sets `*delays` to zero at the beginning, it doesnt do it in case the image is not recognized as GIF and a call to `stbi__load_gif_main_outofmem` only frees possibly allocated memory in `*delays` without resetting it to zero. Thus it would be fair to say the caller of `stbi__load_gif_main` is responsible to free the allocated memory in `*delays` only if `stbi__load_gif_main` returns a non null value. However at the same time the function may return null value, but fail to free the memory in `*delays` if internally `stbi__convert_format` is called and fails. Thus the issue may lead to a memory leak if the caller chooses to free `delays` only when `stbi__load_gif_main` didnt fail or to a double-free if the `delays` is always freed
Double-free
stb_image is a single file MIT licensed library for processing images
CVE-2023-45664
8.8 - High
- October 21, 2023
stb_image is a single file MIT licensed library for processing images. A crafted image file can trigger `stbi__load_gif_main_outofmem` attempt to double-free the out variable. This happens in `stbi__load_gif_main` because when the `layers * stride` value is zero the behavior is implementation defined, but common that realloc frees the old memory and returns null pointer. Since it attempts to double-free the memory a few lines below the first free, the issue can be potentially exploited only in a multi-threaded environment. In the worst case this may lead to code execution.
Double-free
stb_image is a single file MIT licensed library for processing images
CVE-2023-45663
5.5 - Medium
- October 21, 2023
stb_image is a single file MIT licensed library for processing images. The stbi__getn function reads a specified number of bytes from context (typically a file) into the specified buffer. In case the file stream points to the end, it returns zero. There are two places where its return value is not checked: In the `stbi__hdr_load` function and in the `stbi__tga_load` function. The latter of the two is likely more exploitable as an attacker may also control the size of an uninitialized buffer.
Use of Uninitialized Resource
stb_image is a single file MIT licensed library for processing images
CVE-2023-45662
8.1 - High
- October 21, 2023
stb_image is a single file MIT licensed library for processing images. When `stbi_set_flip_vertically_on_load` is set to `TRUE` and `req_comp` is set to a number that doesnt match the real number of components per pixel, the library attempts to flip the image vertically. A crafted image file can trigger `memcpy` out-of-bounds read because `bytes_per_pixel` used to calculate `bytes_per_row` doesnt match the real image array dimensions.
Out-of-bounds Read
stb_image is a single file MIT licensed library for processing images
CVE-2023-45661
7.1 - High
- October 21, 2023
stb_image is a single file MIT licensed library for processing images. A crafted image file may trigger out of bounds memcpy read in `stbi__gif_load_next`. This happens because two_back points to a memory address lower than the start of the buffer out. This issue may be used to leak internal memory allocation information.
Out-of-bounds Read
Nothings stb 2.28 was discovered to contain a Null Pointer Dereference via the function stbi__convert_format
CVE-2023-43898
5.5 - Medium
- October 03, 2023
Nothings stb 2.28 was discovered to contain a Null Pointer Dereference via the function stbi__convert_format. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted pic file.
NULL Pointer Dereference
stb_image.h v2.27 was discovered to contain an heap-based use-after-free
CVE-2022-28042
8.8 - High
- April 15, 2022
stb_image.h v2.27 was discovered to contain an heap-based use-after-free via the function stbi__jpeg_huff_decode.
Dangling pointer
stb_image.h v2.27 was discovered to contain an integer overflow via the function stbi__jpeg_decode_block_prog_dc
CVE-2022-28041
6.5 - Medium
- April 15, 2022
stb_image.h v2.27 was discovered to contain an integer overflow via the function stbi__jpeg_decode_block_prog_dc. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.
Integer Overflow or Wraparound
An issue was discovered in stb stb_image.h 2.27
CVE-2021-42716
7.1 - High
- October 21, 2021
An issue was discovered in stb stb_image.h 2.27. The PNM loader incorrectly interpreted 16-bit PGM files as 8-bit when converting to RGBA, leading to a buffer overflow when later reinterpreting the result as a 16-bit buffer. An attacker could potentially have crashed a service using stb_image, or read up to 1024 bytes of non-consecutive heap data without control over the read location.
Classic Buffer Overflow
An issue was discovered in stb stb_image.h 1.33 through 2.27
CVE-2021-42715
5.5 - Medium
- October 21, 2021
An issue was discovered in stb stb_image.h 1.33 through 2.27. The HDR loader parsed truncated end-of-file RLE scanlines as an infinite sequence of zero-length runs. An attacker could potentially have caused denial of service in applications using stb_image by submitting crafted HDR files.
Infinite Loop
stb_image.h (aka the stb image loader) 2.23
CVE-2019-20056
6.5 - Medium
- December 29, 2019
stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has an assertion failure in stbi__shiftsigned.
assertion failure
stb_image.h (aka the stb image loader) 2.23
CVE-2019-19777
8.8 - High
- December 13, 2019
stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has a heap-based buffer over-read in stbi__load_main.
Out-of-bounds Read
stb stb_image.h 2.19
CVE-2018-16981
8.8 - High
- September 12, 2018
stb stb_image.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer overflow in the stbi__out_gif_code function.
Memory Corruption
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Debian Linux or by Nothings? Click the Watch button to subscribe.
