CVE-2026-102804
mediumA vulnerability was detected in Nothings stb up to 2c980bb59875b0d32144a71867fbdebb2f77cd20.
A vulnerability was detected in Nothings stb up to 2c980bb59875b0d32144a71867fbdebb2f77cd20. The impacted element is the function hexwave_init in the library stb_hexwave.h. Performing a manipulation of the argument width/oversample results in integer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/nothings/stb/ cna@vuldb.com
- https://github.com/nothings/stb/issues/1961 cna@vuldb.com
- https://github.com/user-attachments/files/31351618/poc_hexwave.c cna@vuldb.com
- https://vuldb.com/cve/CVE-2026-102804 cna@vuldb.com
- https://vuldb.com/submit/944861 cna@vuldb.com
- https://vuldb.com/vuln/411496 cna@vuldb.com
- https://vuldb.com/vuln/411496/cti cna@vuldb.com