CVE-2025-3409: falha de média gravidade em Nothings stb
Nothings stb stb_include_string stack-based overflow
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.5%
A vulnerability classified as critical has been found in Nothings stb up to f056911. This affects the function stb_include_string. The manipulation of the argument path_to_includes leads to stack-based buffer overflow. It is possible to initiate the attack remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Produtos afetados
Nothings · stbCVEs relacionadas — Nothings stb
No mesmo produto, das mais perigosas para as menos.
CVE-2026-5314MEDIUMNothings stb TTF File stb_truetype.h stbtt_InitFont_internal out-of-boundsEPSS 0.7%CVE-2025-3406MEDIUMNothings stb Header Array stbhw_build_tileset_from_image out-of-boundsEPSS 0.6%CVE-2026-5315MEDIUMNothings stb TTF File stb_truetype.h stbtt__buf_get8 out-of-boundsEPSS 0.5%CVE-2025-3408MEDIUMNothings stb stb_dupreplace integer overflowEPSS 0.5%CVE-2025-3407MEDIUMNothings stb stbhw_build_tileset_from_image out-of-boundsEPSS 0.5%CVE-2026-5316MEDIUMNothings stb stb_vorbis.c setup_free allocation of resourcesEPSS 0.4%