CVE-2026-5316 - Vulnerability Details

- Nothings stb stb_vorbis.c setup_free allocation of resources

Description

A vulnerability was identified in Nothings stb up to 1.22. The impacted element is the function setup_free of the file stb_vorbis.c. The manipulation leads to allocation of resources. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Published: 2026-04-02

Score: 5.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability lies in the setup_free function of stb_vorbis.c in Nothings stb up to version 1.22. An attacker can manipulate data to trigger allocation of resources, leading to uncontrolled resource consumption. This can potentially cause a denial of service, as the application may exhaust memory or other resources required for normal operation.

Affected Systems

Systems using the Nothings stb library, specifically releases up to and including version 1.22, are affected. No other versions are mentioned as vulnerable. The vulnerability was identified in the upstream source code used by developers embedding stb in their applications.

Risk and Exploitability

With a CVSS score of 5.3, the vulnerability is considered moderate in severity. The exploit is reported as publicly available and remote, though the EPSS score is not disclosed. Since the vendor did not respond to the disclosure, no official patch is currently available. Administrators should expect the risk of denial of service if an attacker can supply crafted data to the vulnerable function.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Nothings

stb

affected

Version	Status	Constraints
`1.0`	affected	—
`1.1`	affected	—
`1.2`	affected	—
`1.3`	affected	—
`1.4`	affected	—
`1.5`	affected	—
`1.6`	affected	—
`1.7`	affected	—
`1.8`	affected	—
`1.9`	affected	—
`1.10`	affected	—
`1.11`	affected	—
`1.12`	affected	—
`1.13`	affected	—
`1.14`	affected	—
`1.15`	affected	—
`1.16`	affected	—
`1.17`	affected	—
`1.18`	affected	—
`1.19`	affected	—
`1.20`	affected	—
`1.21`	affected	—
`1.22`	affected	—

No data.

Vendor Product Confidence Versions

Nothings

Stb

100%

Version	Status	Scheme	Platform
`[1.0,1.0]`	affected	generic	—
`[1.1,1.1]`	affected	generic	—
`[1.2,1.2]`	affected	generic	—
`[1.3,1.3]`	affected	generic	—
`[1.4,1.4]`	affected	generic	—
`[1.5,1.5]`	affected	generic	—
`[1.6,1.6]`	affected	generic	—
`[1.7,1.7]`	affected	generic	—
`[1.8,1.8]`	affected	generic	—
`[1.9,1.9]`	affected	generic	—
`[1.10,1.10]`	affected	generic	—
`[1.11,1.11]`	affected	generic	—
`[1.12,1.12]`	affected	generic	—
`[1.13,1.13]`	affected	generic	—
`[1.14,1.14]`	affected	generic	—
`[1.15,1.15]`	affected	generic	—
`[1.16,1.16]`	affected	generic	—
`[1.17,1.17]`	affected	generic	—
`[1.18,1.18]`	affected	generic	—
`[1.19,1.19]`	affected	generic	—
`[1.20,1.20]`	affected	generic	—
`[1.21,1.21]`	affected	generic	—
`[1.22,1.22]`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Verify the stb library version being used in your application.
If the version is 1.22 or earlier, upgrade to the latest release from the Nothings stb repository.
In the absence of an official patch, isolate the vulnerable component by limiting its resource usage or running it in a sandboxed environment.
Monitor application logs for abnormal memory or CPU consumption and alert on potential exploitation attempts.
If upgrading is not feasible, consider removing or replacing the stb library with a more actively maintained alternative.

Generated by OpenCVE AI on April 2, 2026 at 02:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction Required

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00036.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://gist.github.com/d0razi/cc7f70bba08c1a455d9933e97b8b57c1
https://vuldb.com/submit/780560
https://vuldb.com/vuln/354648
https://vuldb.com/vuln/354648/cti

History

Thu, 02 Apr 2026 20:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Nothings Nothings stb
Vendors & Products		Nothings Nothings stb
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 02 Apr 2026 00:00:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability was identified in Nothings stb up to 1.22. The impacted element is the function setup_free of the file stb_vorbis.c. The manipulation leads to allocation of resources. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title		Nothings stb stb_vorbis.c setup_free allocation of resources
Weaknesses		CWE-400 CWE-770
References		https://gist.github.com/d0razi/cc7f70bba08c1a455d9933e97b8b57c1 https://vuldb.com/submit/780560 https://vuldb.com/vuln/354648 https://vuldb.com/vuln/354648/cti
Metrics		cvssV2_0 `{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Nothings Stb

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-04-02T00:00:18.137Z

Updated: 2026-04-02T18:24:28.334Z

Reserved: 2026-04-01T12:40:09.662Z

Link: CVE-2026-5316

Vulnrichment

Updated: 2026-04-02T18:24:04.708Z

NVD

Status : Awaiting Analysis

Published: 2026-04-02T00:16:25.410

Modified: 2026-04-03T16:10:52.680

Link: CVE-2026-5316

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-04-02T20:15:51Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction Required

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object