Riskcovery

CVE-2026-5185

Nothings stb_image Multi-frame GIF File stb_image.h stbi__gif_load_next heap-based overflow

State
Published
Severity
4.8 Medium
Published
Mar 31, 2026
Updated
Mar 31, 2026
Reserved
Mar 30, 2026

Read the record on cve.org

Description

A security flaw has been discovered in Nothings stb_image up to 2.30. This affects the function stbi__gif_load_next of the file stb_image.h of the component Multi-frame GIF File Handler. The manipulation results in heap-based buffer overflow. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Scores

CVSSScoreVectorSource
4.04.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:PVulDB
3.15.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:RVulDB
3.05.3 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:RVulDB
2.04.3 MediumAV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:URVulDB

Weaknesses

Affected Products

ProductVersions
stb_imageNothings
  • 2.0Affected
  • 2.1Affected
  • 2.2Affected
  • 2.3Affected
  • 2.4Affected
  • 2.5Affected
  • 2.6Affected
  • 2.7Affected
  • 2.8Affected
  • 2.9Affected
  • 2.10Affected
  • 2.11Affected
  • 2.12Affected
  • 2.13Affected
  • 2.14Affected
  • 2.15Affected
  • 2.16Affected
  • 2.17Affected
  • 2.18Affected
  • 2.19Affected
  • 2.20Affected
  • 2.21Affected
  • 2.22Affected
  • 2.23Affected
  • 2.24Affected
  • and 6 more versions

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.