---
id: CVE-2026-102805
title: A flaw has been found in Nothings stb up to 1.16
summary: >-
  A flaw has been found in Nothings stb up to 1.16. This affects the function
  stbi_write_png_to_mem/stbi_write_jpg_core/stbi_write_tga_core in the library
  stb_image_write.h of the component Image Encoding. Executing a manipulation
  can lead…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'
cwe:
  - CWE-189
  - CWE-190
vendor: Nothings
product: stb
affected:
  - stb 1.0
  - stb 1.1
  - stb 1.2
  - stb 1.3
  - stb 1.4
  - stb 1.5
  - stb 1.6
  - stb 1.7
  - stb 1.8
  - stb 1.9
  - stb 1.10
  - stb 1.11
  - stb 1.12
  - stb 1.13
  - stb 1.14
  - stb 1.15
  - stb 1.16
published: '2026-09-30'
updated: '2026-09-30'
sourceUpdated: '2026-09-30T01:16:36.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102805'
references:
  - url: 'https://github.com/nothings/stb/'
    label: cna@vuldb.com
  - url: 'https://github.com/nothings/stb/issues/1964'
    label: cna@vuldb.com
  - url: 'https://github.com/nothings/stb/issues/1964#issuecomment-5404606996'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/cve/CVE-2026-102805'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/944868'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/411497'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/411497/cti'
    label: cna@vuldb.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-30T00:53:47.826Z'
---

## Overview

A flaw has been found in Nothings stb up to 1.16. This affects the function stbi_write_png_to_mem/stbi_write_jpg_core/stbi_write_tga_core in the library stb_image_write.h of the component Image Encoding. Executing a manipulation can lead to integer overflow. The attack can be executed remotely. The exploit has been published and may be used.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.