A double‑free condition exists in the stb_image.h Multi‑frame GIF File Handler of the Nothings stb library. When stbi__load_gif_main processes a crafted GIF file, the same memory block is released twice, corrupting the heap. The CVE details do not indicate that arbitrary code execution is achieved, but the memory corruption could lead to application crashes or instability. The vulnerability is publicly exploitable, as exploit code is available, and requires that the attacker has local access to the target system.

Any software that incorporates the Nothings stb library version 2.30 or earlier and uses its stb_image.h header to decode GIF images is affected. The bug resides in the header‑only implementation, so the issue is present wherever the library is built into an application. No other vendors or product families are listed in the CVE data.

The CVSS v3 base score is 4.8, indicating a moderate severity assessment. No EPSS score is supplied, and the vulnerability is not listed in the CISA KEV catalog. Exploitation necessitates local access and the attacker must supply a malicious GIF file to a running process that uses stbi__load_gif_main. Because public exploit code exists, a local attacker could trigger the double‑free, potentially causing a crash or corrupting memory, but there is no evidence of remote exploitation or privilege escalation.