VulnerabilityAnalyzed

CVE-2026-5316

A vulnerability was identified in Nothings stb up to 1.22.

LOW 2.1EPSS 0.44%

Does this matter?

Lower severity and a low EPSS score (0.44%). Track it; it rarely justifies an emergency change on its own.

Description

A vulnerability was identified in Nothings stb up to 1.22. The impacted element is the function setup_free of the file stb_vorbis.c. The manipulation leads to allocation of resources. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0: 2.1 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.44% probability · 37th percentile
CISA KEV: Not listed
Weakness: CWE-400, CWE-770
Affected: nothings/stb vorbis.c
Source: cna@vuldb.com

References

https://gist.github.com/d0razi/cc7f70bba08c1a455d9933e97b8b57c1Exploit, Third Party Advisory
https://vuldb.com/submit/780560Third Party Advisory, VDB Entry
https://vuldb.com/vuln/354648Third Party Advisory, VDB Entry
https://vuldb.com/vuln/354648/ctiPermissions Required, VDB Entry

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.