# cve.now: Nothings

The newest entries naming Nothings as an affected vendor (up to 200), of 28 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-102805](https://cve.now/CVE-2026-102805.md): Nothings stb Image Encoding stb\_image\_write.h stbi\_write\_tga\_core integer overflow (CVSS 6.9)
- [CVE-2026-102804](https://cve.now/CVE-2026-102804.md): Nothings stb stb\_hexwave.h hexwave\_init integer overflow (CVSS 6.9)
- [CVE-2026-89266](https://cve.now/CVE-2026-89266.md): stb\_vorbis through 1.22 heap buffer overflow via codebook multiplicands (CVSS 8.8)
- [CVE-2026-5317](https://cve.now/CVE-2026-5317.md): Nothings stb stb\_vorbis.c start\_decoder out-of-bounds write (CVSS 5.3)
- [CVE-2026-5316](https://cve.now/CVE-2026-5316.md): Nothings stb stb\_vorbis.c setup\_free allocation of resources (CVSS 5.3)
- [CVE-2026-5315](https://cve.now/CVE-2026-5315.md): Nothings stb TTF File stb\_truetype.h stbtt\_\_buf\_get8 out-of-bounds (CVSS 5.3)
- [CVE-2026-5314](https://cve.now/CVE-2026-5314.md): Nothings stb TTF File stb\_truetype.h stbtt\_InitFont\_internal out-of-bounds (CVSS 5.3)
- [CVE-2026-5313](https://cve.now/CVE-2026-5313.md): Nothings stb GIF Decoder stb\_image.h stbi\_\_gif\_load\_next denial of service (CVSS 5.3)
- [CVE-2026-5186](https://cve.now/CVE-2026-5186.md): Nothings stb Multi-frame GIF File stb\_image.h stbi\_\_load\_gif\_main double free (CVSS 4.8)
- [CVE-2026-5185](https://cve.now/CVE-2026-5185.md): Nothings stb\_image Multi-frame GIF File stb\_image.h stbi\_\_gif\_load\_next heap-based overflow (CVSS 4.8)
- [CVE-2025-3409](https://cve.now/CVE-2025-3409.md): Nothings stb stb\_include\_string stack-based overflow (CVSS 5.3)
- [CVE-2025-3408](https://cve.now/CVE-2025-3408.md): Nothings stb stb\_dupreplace integer overflow (CVSS 5.3)
- [CVE-2025-3407](https://cve.now/CVE-2025-3407.md): Nothings stb stbhw\_build\_tileset\_from\_image out-of-bounds (CVSS 5.3)
- [CVE-2025-3406](https://cve.now/CVE-2025-3406.md): Nothings stb Header Array stbhw\_build\_tileset\_from\_image out-of-bounds (CVSS 5.3)
- [CVE-2023-45682](https://cve.now/CVE-2023-45682.md): Wild address read in vorbis\_decode\_packet\_rest in stb\_vorbis (CVSS 5.3)
- [CVE-2023-45681](https://cve.now/CVE-2023-45681.md): Out of bounds heap buffer write in stb\_vorbis (CVSS 7.3)
- [CVE-2023-45680](https://cve.now/CVE-2023-45680.md): Null pointer dereference in vorbis\_deinit in stb\_vorbis (CVSS 5.3)
- [CVE-2023-45679](https://cve.now/CVE-2023-45679.md): Attempt to free an uninitialized memory pointer in vorbis\_deinit in stb\_vorbis (CVSS 7.3)
- [CVE-2023-45678](https://cve.now/CVE-2023-45678.md): Off-by-one heap buffer write in start\_decoder in stb\_vorbis (CVSS 6.5)
- [CVE-2023-45677](https://cve.now/CVE-2023-45677.md): Heap buffer out of bounds write in start\_decoder in stb\_vorbis (CVSS 7.3)
- [CVE-2023-45676](https://cve.now/CVE-2023-45676.md): Multi-byte write heap buffer overflow in start\_decoder in stb\_vorbis (CVSS 7.3)
- [CVE-2023-45675](https://cve.now/CVE-2023-45675.md): 0 byte write heap buffer overflow in start\_decoder in stb\_vorbis (CVSS 6.5)
- [CVE-2023-45667](https://cve.now/CVE-2023-45667.md): Null pointer dereference because of an uninitialized variable in stb\_image (CVSS 5.3)
- [CVE-2023-45666](https://cve.now/CVE-2023-45666.md): Possible double-free or memory leak in stbi\_\_load\_gif\_main in stb\_image (CVSS 7.3)
- [CVE-2023-45664](https://cve.now/CVE-2023-45664.md): Double-free in stbi\_\_load\_gif\_main\_outofmem in stb\_image (CVSS 7.3)
- [CVE-2023-45663](https://cve.now/CVE-2023-45663.md): Disclosure of uninitialized memory in stbi\_\_tga\_load in stb\_image (CVSS 5.3)
- [CVE-2023-45662](https://cve.now/CVE-2023-45662.md): Multi-byte read heap buffer overflow in stbi\_\_vertical\_flip in stb\_image (CVSS 6.5)
- [CVE-2023-45661](https://cve.now/CVE-2023-45661.md): Wild address read in stbi\_\_gif\_load\_next in stb\_image (CVSS 6.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/nothings
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.