The vulnerability resides in the stbi__gif_load_next function of the stb_image.h library used by Nothings' stb. It allows an attacker to supply a specially crafted GIF file that causes uncontrolled memory allocation and ultimately crashes the image decoder, resulting in a denial‑of‑service state. The weakness is identified as CWE‑1286 and CWE‑404. Because the function processes input from external GIF files, the impact arises when a malicious GIF is loaded through the library.

Any deployment that incorporates Nothings stb version 2.30 or earlier is affected. This includes software that embeds stb_image.h for image loading such as certain game engines, rendering frameworks, and web applications. The vendor product is Nothings:stb; no specific sub‑product is listed. The vulnerability applies to all platforms that compile the library with the default GIF decoder.

The CVSS score of 5.3 indicates moderate severity. EPSS data is not provided and the vulnerability is not listed in CISA’s KEV catalog, suggesting it is not currently exploited in the wild. However, the attack can be launched remotely via a crafted GIF file and the public exploit is disclosed, so systems that load untrusted GIFs remain at risk. Updating to a fixed version or disabling GIF support mitigates the risk.