CVE-2025-3406
CVE-2025-3406 is a medium-severity vulnerability in Nothings Stb Image.h with a CVSS 3.x base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-119.
Key facts
- Severity: Medium (CVSS 3.x base score 4.3)
- CVSS v2: 5.0
- CVSS v4: 5.3
- EPSS exploit prediction: 1% (40th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2025-10385
- Weakness: CWE-119
- Affected product: Nothings Stb Image.h
- Published:
- Last modified:
Description
A vulnerability was found in Nothings stb up to f056911. It has been classified as problematic. Affected is the function stbhw_build_tileset_from_image of the component Header Array Handler. The manipulation of the argument w leads to out-of-bounds read. It is possible to launch the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
Frequently asked questions
- What is CVE-2025-3406?
- A vulnerability was found in Nothings stb up to f056911. It has been classified as problematic. Affected is the function stbhw_build_tileset_from_image of the component Header Array Handler. The manipulation of the argument w leads to out-of-bounds read. It is possible to launch the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
- How severe is CVE-2025-3406?
- CVE-2025-3406 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity none, and availability none.
- Is CVE-2025-3406 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (40th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2025-3406?
- CVE-2025-3406 affects Nothings Stb Image.h. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2025-3406?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2025-3406 have an EU (EUVD) identifier?
- Yes. CVE-2025-3406 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-10385.
- When was CVE-2025-3406 published?
- CVE-2025-3406 was published on 2025-04-08 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:nothings:stb_image.h:*:*:*:*:*:*:*:*
More vulnerabilities in Nothings Stb Image.h
- CVE-2022-28042 — High (CVSS 8.8): stb_image.h v2.27 was discovered to contain an heap-based use-after-free via the function stbi__jpeg_huff_decode.
- CVE-2019-19777 — High (CVSS 8.8): stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has a heap-based buffer over-read…
- CVE-2018-16981 — High (CVSS 8.8): stb stb_image.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer overflow in the…
- CVE-2023-45666 — High (CVSS 7.3): stb_image is a single file MIT licensed library for processing images. It may look like `stbi__load_gif_main`…
- CVE-2023-45664 — High (CVSS 7.3): stb_image is a single file MIT licensed library for processing images. A crafted image file can trigger…
- CVE-2021-42716 — High (CVSS 7.1): An issue was discovered in stb stb_image.h 2.27. The PNM loader incorrectly interpreted 16-bit PGM files as 8-bit when…
All CVEs affecting Nothings Stb Image.h →
Other CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) vulnerabilities
- CVE-2026-2778 — Critical (CVSS 10.0): Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in…
- CVE-2026-2776 — Critical (CVSS 10.0): Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability…
- CVE-2025-1866 — Critical (CVSS 10.0): Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in warmcat libwebsockets allows…
- CVE-2022-27625 — Critical (CVSS 10.0): A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the…
- CVE-2022-27624 — Critical (CVSS 10.0): A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the…
- CVE-2020-11896 — Critical (CVSS 10.0): The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling.