CVE-2026-102804— Nothings stb stb_hexwave.h hexwave_init integer overflow
Quick assessment
Affected
Nothings stb
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Nothings 的 stb 库（截至提交哈希 2c980bb59875b0d32144a71867fbdebb2f77cd20）中发现了一个安全漏洞。受影响的组件是 stb_hexwave.h 库中的 hexwave_init 函数。对参数 width 或 oversample 进行操作可导致整数溢出。该漏洞可被远程利用。目前相关利用代码已公开，可被直接使用。项目方已通过问题报告较早得知此漏洞，但截至目前尚未作出回应。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-102804
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Nothings stb stb_hexwave.h hexwave_init integer overflow
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was detected in Nothings stb up to 2c980bb59875b0d32144a71867fbdebb2f77cd20. The impacted element is the function hexwave_init in the library stb_hexwave.h. Performing a manipulation of the argument width/oversample results in integer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
整数溢出或超界折返
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-102804
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-102804
请登录查看更多情报信息。
Other References for CVE-2026-102804 (7)
-
https://github.com/nothings/stb/issues/1961 issue-tracking
-
https://github.com/nothings/stb/ product
-
https://vuldb.com/cve/CVE-2026-102804 third-party-advisory
-
-
-
https://vuldb.com/submit/944861 third-party-advisory
IV. Related Vulnerabilities
Same product: stb
-
CVE-2026-102805
Nothings stb Image Encoding stb_image_write.h stbi_write_tga -
CVE-2026-5317
Nothings stb stb_vorbis.c start_decoder out-of-bounds write -
CVE-2026-5316
Nothings stb stb_vorbis.c setup_free allocation of resources -
CVE-2026-5315
Nothings stb TTF File stb_truetype.h stbtt__buf_get8 out-of- -
CVE-2026-5314
Nothings stb TTF File stb_truetype.h stbtt_InitFont_internal
Same vendor: Nothings
-
CVE-2026-102805
Nothings stb Image Encoding stb_image_write.h stbi_write_tga -
CVE-2026-89266
stb_vorbis through 1.22 heap buffer overflow via codebook mu -
CVE-2026-5317
Nothings stb stb_vorbis.c start_decoder out-of-bounds write -
CVE-2026-5316
Nothings stb stb_vorbis.c setup_free allocation of resources -
CVE-2026-5315
Nothings stb TTF File stb_truetype.h stbtt__buf_get8 out-of-
Same weakness: CWE-190
-
CVE-2026-102805
Nothings stb Image Encoding stb_image_write.h stbi_write_tga -
CVE-2026-102621
Freedesktop Poppler SplashClip.cc clipToPath integer overflo -
CVE-2026-71973
U-Boot before 2026.10-rc4 Integer Overflow in SquashFS Direc -
CVE-2026-102620
Freedesktop Poppler FoFiTrueType.cc cvtSfnts integer overflo -
CVE-2026-95308
Chrome 154.0.8037.57整数溢出致沙箱内存读取
V. Comments for CVE-2026-102804
No comments yet