CVE-2019-20056
CVE-2019-20056 is a medium-severity vulnerability in Nothings Stb Image.h with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-617.
Key facts
- Severity: Medium (CVSS 3.x base score 6.5)
- CVSS v2: 4.3
- EPSS exploit prediction: 1% (56th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-617
- Affected product: Nothings Stb Image.h
- Published:
- Last modified:
Description
stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has an assertion failure in stbi__shiftsigned.
Frequently asked questions
- What is CVE-2019-20056?
- stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has an assertion failure in stbi__shiftsigned.
- How severe is CVE-2019-20056?
- CVE-2019-20056 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity none, and availability high.
- Is CVE-2019-20056 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (56th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2019-20056?
- CVE-2019-20056 affects Nothings Stb Image.h. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2019-20056?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2019-20056 published?
- CVE-2019-20056 was published on 2019-12-29 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:nothings:stb_image.h:2.23:*:*:*:*:*:*:*
More vulnerabilities in Nothings Stb Image.h
- CVE-2022-28042 — High (CVSS 8.8): stb_image.h v2.27 was discovered to contain an heap-based use-after-free via the function stbi__jpeg_huff_decode.
- CVE-2019-19777 — High (CVSS 8.8): stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has a heap-based buffer over-read…
- CVE-2018-16981 — High (CVSS 8.8): stb stb_image.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer overflow in the…
- CVE-2023-45666 — High (CVSS 7.3): stb_image is a single file MIT licensed library for processing images. It may look like `stbi__load_gif_main`…
- CVE-2023-45664 — High (CVSS 7.3): stb_image is a single file MIT licensed library for processing images. A crafted image file can trigger…
- CVE-2021-42716 — High (CVSS 7.1): An issue was discovered in stb stb_image.h 2.27. The PNM loader incorrectly interpreted 16-bit PGM files as 8-bit when…
All CVEs affecting Nothings Stb Image.h →
Other CWE-617 (Reachable Assertion) vulnerabilities
- CVE-2020-3615 — Critical (CVSS 9.8): Valid deauth/disassoc frames is dropped in case if RMF is enabled and some rouge peer keep on sending rogue…
- CVE-2019-9795 — Critical (CVSS 9.8): A vulnerability where type-confusion in the IonMonkey just-in-time (JIT) compiler could potentially be used by…
- CVE-2026-31739 — High (CVSS 8.8): In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - Add missing CRYPTO_ALG_ASYNC The…
- CVE-2020-12417 — High (CVSS 8.8): Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in…
- CVE-2020-6623 — High (CVSS 8.8): stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_get_index.
- CVE-2020-6619 — High (CVSS 8.8): stb stb_truetype.h through 1.22 has an assertion failure in stbtt__buf_seek.