CVE-2026-79516: Medium severity Nothings stb_sprintf.h vulnerability
An out-of-bounds read in the stbspvsnprintf function (stbsprintf.h) of nothings stb commit 31c1ad3 allows attackers to cause a Denial of Service (DoS) via sending a crafted input.
Affected Software
Event History
Frequently Asked Questions
What access and interaction does exploitation require?
The attack vector is local and exploitation has high complexity. The vector indicates no privileges and no user interaction are required, but an attacker must be able to provide a crafted input to the vulnerable formatting function.
What security impact is indicated beyond service disruption?
The supplied vector indicates low availability and integrity impact, with no confidentiality impact. The reported issue is an out-of-bounds read that can be used for denial of service.
How can I determine whether my code is in scope?
Check whether your application includes or vendors the Nothings stb_sprintf.h code associated with stb commit 31c1ad3, and whether crafted input can reach stbsp_vsnprintf.