In the stbi__gif_load_next routine of the Multi‑frame GIF File Handler within stb_image, a heap‑based buffer overflow can be triggered by feeding a maliciously crafted GIF. The overflow corrupts heap memory and allows an attacker with local access to possibly execute arbitrary code or crash the application. This weakness corresponds to CWE‑119 and CWE‑122.

The vulnerability affects Nothings stb_image versions 2.30 and earlier. Any application that includes this library and processes GIF images is potentially vulnerable. The flaw is independent of host OS or architecture.

The CVSS score of 4.8 indicates a low‑to‑medium impact, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog, suggesting limited observed exploitation. However, the publicly released exploit and the local-privilege requirement mean that any local user or compromised process that parses a crafted GIF can exploit the overflow, potentially leading to arbitrary code execution.