Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (16 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2019-19777 2 Nothings, Saitoha 2 Stb Image.h, Libsixel 2026-04-24 8.8 High
stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has a heap-based buffer over-read in stbi__load_main.
CVE-2023-45681 1 Nothings 2 Stb, Stb Vorbis.c 2025-02-13 7.3 High
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory write past an allocated heap buffer in `start_decoder`. The root cause is a potential integer overflow in `sizeof(char*) * (f->comment_list_length)` which may make `setup_malloc` allocate less memory than required. Since there is another integer overflow an attacker may overflow it too to force `setup_malloc` to return 0 and make the exploit more reliable. This issue may lead to code execution.
CVE-2023-45682 1 Nothings 1 Stb Vorbis.c 2024-11-21 5.3 Medium
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds read in `DECODE` macro when `var` is negative. As it can be seen in the definition of `DECODE_RAW` a negative `var` is a valid value. This issue may be used to leak internal memory allocation information.
CVE-2023-45680 1 Nothings 1 Stb Vorbis.c 2024-11-21 5.3 Medium
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory allocation failure in `start_decoder`. In that case the function returns early, the `f->comment_list` is set to `NULL`, but `f->comment_list_length` is not reset. Later in `vorbis_deinit` it tries to dereference the `NULL` pointer. This issue may lead to denial of service.
CVE-2023-45679 1 Nothings 1 Stb Vorbis.c 2024-11-21 7.3 High
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory allocation failure in `start_decoder`. In that case the function returns early, but some of the pointers in `f->comment_list` are left initialized and later `setup_free` is called on these pointers in `vorbis_deinit`. This issue may lead to code execution.
CVE-2023-45677 1 Nothings 1 Stb Vorbis.c 2024-11-21 7.3 High
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[len] = (char)'\0';`. The root cause is that if `len` read in `start_decoder` is a negative number and `setup_malloc` successfully allocates memory in that case, but memory write is done with a negative index `len`. Similarly if len is INT_MAX the integer overflow len+1 happens in `f->vendor = (char*)setup_malloc(f, sizeof(char) * (len+1));` and `f->comment_list[i] = (char*)setup_malloc(f, sizeof(char) * (len+1));`. This issue may lead to code execution.
CVE-2023-45676 1 Nothings 1 Stb Vorbis.c 2024-11-21 7.3 High
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[i] = get8_packet(f);`. The root cause is an integer overflow in `setup_malloc`. A sufficiently large value in the variable `sz` overflows with `sz+7` in and the negative value passes the maximum available memory buffer check. This issue may lead to code execution.
CVE-2020-6623 1 Nothings 1 Stb Truetype.h 2024-11-21 8.8 High
stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_get_index.
CVE-2020-6622 1 Nothings 1 Stb Truetype.h 2024-11-21 8.8 High
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_peek8.
CVE-2020-6621 1 Nothings 1 Stb Truetype.h 2024-11-21 8.8 High
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in ttUSHORT.
CVE-2020-6620 1 Nothings 1 Stb Truetype.h 2024-11-21 8.8 High
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_get8.
CVE-2020-6619 1 Nothings 1 Stb Truetype.h 2024-11-21 8.8 High
stb stb_truetype.h through 1.22 has an assertion failure in stbtt__buf_seek.
CVE-2020-6618 1 Nothings 1 Stb Truetype.h 2024-11-21 8.8 High
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__find_table.
CVE-2020-6617 1 Nothings 1 Stb Truetype.h 2024-11-21 8.8 High
stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_int.
CVE-2019-20056 1 Nothings 1 Stb Image.h 2024-11-21 6.5 Medium
stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has an assertion failure in stbi__shiftsigned.
CVE-2018-16981 2 Debian, Nothings 2 Debian Linux, Stb Image.h 2024-11-21 8.8 High
stb stb_image.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer overflow in the stbi__out_gif_code function.