Nothings stb Multi-frame GIF File stb_image.h stbi__load_gif_main double free
Priority LOW 21CWE-119Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
A weakness has been identified in Nothings stb up to 2.30. This impacts the function stbi__load_gif_main of the file stb_image.h of the component Multi-frame GIF File Handler. This manipulation causes double free. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00115 1st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nothings | stb | 2.0; 2.1; 2.2; 2.3; 2.4; 2.5; 2.6; 2.7; 2.8; 2.9; 2.10; 2.11; 2.12; 2.13; 2.14; 2.15; 2.16; 2.17; 2.18; 2.19; 2.20; 2.21; 2.22; 2.23; 2.24; 2.25; 2.26; 2.27; 2.28; 2.29; 2.30 | — | No fix listed | CNA |
- stb Vendornothings Affected 2.0; 2.1; 2.2; 2.3; 2.4; 2.5; 2.6; 2.7; 2.8; 2.9; 2.10; 2.11; 2.12; 2.13; 2.14; 2.15; 2.16; 2.17; 2.18; 2.19; 2.20; 2.21; 2.22; 2.23; 2.24; 2.25; 2.26; 2.27; 2.28; 2.29; 2.30 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2026-5186
- 2026-10-03 Alias added: GHSA-593x-hf83-hmrv
References
—
More nothings vulnerabilities
- TI-2023-25531 Integer overflow in stb_vorbis.c CVSS 3.1CRITICAL 9.8
- TI-2023-24466 Possible double-free or memory leak in stbi__load_gif_main in stb_image CVSS 3.1CRITICAL 9.8
- TI-2026-60440 stb_vorbis through 1.22 heap buffer overflow via codebook multiplicands CVSS 4.0HIGH 8.8
- TI-2023-24465 Double-free in stbi__load_gif_main_outofmem in stb_image CVSS 3.1HIGH 8.8
- TI-2023-24463 Multi-byte read heap buffer overflow in stbi__vertical_flip in stb_image CVSS 3.1HIGH 8.1
- TI-2023-24478 Attempt to free an uninitialized memory pointer in vorbis_deinit in stb_vorbis CVSS 3.1HIGH 7.8
Sources
- CVE-2026-5186 · CVE Program
- CVE-2026-5186 · NVD
- FIRST EPSS
- GHSA-593x-hf83-hmrv · GitHub Advisory Database · CC BY 4.0
- CVE-2026-5186 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences