CVE-2026-102805
Received Received - Intake

Integer Overflow in stb Image Encoding Library

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: VulDB

Description
A flaw has been found in Nothings stb up to 1.16. This affects the function stbi_write_png_to_mem/stbi_write_jpg_core/stbi_write_tga_core in the library stb_image_write.h of the component Image Encoding. Executing a manipulation can lead to integer overflow. The attack can be executed remotely. The exploit has been published and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-09-30
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-102805
EUVD
EUVD-2026-89536

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nothings stb to 1.16 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-190 The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
CWE-189

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-102805 is an integer overflow vulnerability in the stb_image_write.h library, specifically in functions used for encoding images in PNG, JPEG, and TGA formats. The issue occurs when 32-bit integer arithmetic for size or offset calculations exceeds INT_MAX, leading to incorrect memory allocations or invalid memory accesses. This can cause heap buffer overflows or out-of-bounds memory reads when processing large images.

Detection Guidance

Detecting this vulnerability requires checking if your system uses a vulnerable version of stb_image_write.h. Inspect project dependencies for stb libraries and verify versions. For codebases, search for stbi_write_png_to_mem, stbi_write_jpg_core, or stbi_write_tga_core functions. Use static analysis tools to detect integer overflows in size calculations. Monitor for crashes or memory corruption when processing large images.

Impact Analysis

This vulnerability can be exploited remotely by manipulating image data, potentially leading to crashes, data corruption, or arbitrary code execution. Attackers could craft malicious images that trigger the overflow, causing memory corruption during image encoding processes.

Mitigation Strategies

Immediately update to the latest version of stb libraries if a fix is available. If using stb_image_write.h, replace it with a patched version or switch to alternative image encoding libraries. Disable image processing features temporarily if updates are not possible. Monitor vendor advisories for patches and apply them promptly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102805. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart