PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-3406 Nothings CVE debrief

A vulnerability in Nothings stb image library, specifically in the stbhw_build_tileset_from_image function of the Header Array Handler component, allows out-of-bounds read through manipulation of the width argument. The issue affects stb_image.h up to version 2.13 and can be exploited remotely. The vendor uses a rolling release model and did not respond to disclosure attempts.

Vendor
Nothings
Product
stb
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2025-04-08
Original CVE updated
2026-05-19
Advisory published
2025-04-08
Advisory updated
2026-05-19

Who should care

Developers using stb_image.h for image processing, particularly in server-side or networked applications; security teams managing C/C++ dependencies; organizations processing untrusted image uploads

Technical summary

The stbhw_build_tileset_from_image function in Nothings stb image library fails to properly validate the width (w) argument, resulting in an out-of-bounds read condition. This vulnerability exists in the Header Array Handler component and can be triggered remotely when processing crafted image data. The affected product uses a continuous delivery model via rolling release, complicating version-specific patching. The vendor was contacted prior to disclosure but did not respond.

Defensive priority

medium

Recommended defensive actions

  • Review applications using stb_image.h for processing untrusted image data
  • Implement input validation on image dimensions before passing to stbhw_build_tileset_from_image
  • Consider sandboxing image processing operations
  • Monitor for updates from the stb repository despite vendor non-response
  • Apply principle of least privilege to image processing components

Evidence notes

Vulnerability confirmed through NVD analysis with CVSS 4.0 vector. Affected versions identified via CPE criteria. Vendor non-response documented in CNA submission records.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-3406 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-3406

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-3406 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-3406

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.