An out‑of‑bounds read in the stbsp_vsnprintf function of stb_sprintf.h causes the program to read memory beyond a buffer limit, potentially leading to crashes or uncontrolled resource usage. The flaw can be exploited by supplying crafted input, allowing an attacker to trigger a denial of service. There is no direct evidence from the description that the vulnerability can be leveraged for arbitrary code execution or data exfiltration. The weakness is categorized as an out‑of‑bounds read (CWE-126).

The vulnerable code resides in the stb library maintained by the nothings project and is commonly incorporated into numerous C/C++ projects. No vendor or product names are listed in the CVE entry, but any build that includes the stb_sprintf.h header with the commit that introduced the bug (31c1ad3) is affected. Users should verify whether their applications link against this version of stb and assess whether the function is invoked with untrusted input.

The CVSS score of 4 classifies the issue as medium severity. EPSS is not available, making it difficult to gauge the probability of exploitation, but no indications of active exploitation exist, as the OSI KEV catalogue lists it as not exploited. The attack would require an attacker to supply malicious input to the stbsp_vsnprintf routine, which is likely to be a local or controlled‑environment vector rather than a remote one, because the function is typically called within application code. Given the lack of elevated privileges or remote code execution, the risk is primarily a denial of service rather than a breach of confidentiality or integrity.