CVE-2026-102805: Nothings stb Image Encoding stb_image_write.h stbi_write_tga_core integer overflow

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-30 · updated 2026-10-01
Weakness: CWE-189

Description

A flaw has been found in Nothings stb up to 1.16. This affects the function stbi_write_png_to_mem/stbi_write_jpg_core/stbi_write_tga_core in the library stb_image_write.h of the component Image Encoding. Executing a manipulation can lead to integer overflow. The attack can be executed remotely. The exploit has been published and may be used.

Affected products

nothings stb: 1.0, 1.1, 1.2, 1.3, 1.4, 1.5 (+11)

References

https://github.com/nothings/stb/
https://github.com/nothings/stb/issues/1964
https://github.com/nothings/stb/issues/1964#issuecomment-5404606996
https://vuldb.com/cve/CVE-2026-102805
https://vuldb.com/submit/944868
https://vuldb.com/vuln/411497
https://vuldb.com/vuln/411497/cti

Get alerted when CVE-2026-102805 or the next vulnerability affects your stack