CVE-2025-3406: Nothings stb Header Array stbhw_build_tileset_from_image out-of-bounds
First published: Tue Apr 08 2025(Updated: )
A vulnerability was found in Nothings stb up to f056911. It has been classified as problematic. Affected is the function stbhw_build_tileset_from_image of the component Header Array Handler. The manipulation of the argument w leads to out-of-bounds read. It is possible to launch the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
Credit: cna@vuldb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Nothing OS | <=f056911 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-3406?
CVE-2025-3406 has been classified as problematic due to its potential for out-of-bounds read vulnerabilities.
How do I fix CVE-2025-3406?
To fix CVE-2025-3406, update to a version of Nothings stb later than f056911.
What component is affected by CVE-2025-3406?
CVE-2025-3406 affects the Header Array Handler in the function stbhw_build_tileset_from_image.
What type of vulnerability is CVE-2025-3406?
CVE-2025-3406 is an out-of-bounds read vulnerability that occurs due to improper manipulation of the argument w.
Which software versions are impacted by CVE-2025-3406?
CVE-2025-3406 affects Nothings stb up to and including version f056911.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/references
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/type
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/severity
- agent/last-modified-date
- agent/author
- agent/event
- collector/epss-latest
- source/FIRST
- agent/source
- agent/epss
- agent/tags
- vendor/nothings
- canonical/nothing os