CVE-2019-15058

Severity: critical (CVSS 9.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-08-14 · updated 2026-06-17
Weakness: CWE-125

Description

stb_image.h (aka the stb image loader) 2.23 has a heap-based buffer over-read in stbi__tga_load, leading to Information Disclosure or Denial of Service.

Affected products

Stb Project Stb: 2.23

References

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=934973
https://github.com/nothings/stb/issues/790
https://security-tracker.debian.org/tracker/CVE-2019-15058
https://www.cvedetails.com/cve/CVE-2019-15058/
https://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg1695025.html
https://www.suse.com/security/cve/CVE-2019-15058/
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=934973
https://github.com/nothings/stb/issues/790
https://security-tracker.debian.org/tracker/CVE-2019-15058
https://www.cvedetails.com/cve/CVE-2019-15058/
https://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg1695025.html
https://www.suse.com/security/cve/CVE-2019-15058/

Get alerted when CVE-2019-15058 or the next vulnerability affects your stack