Nothings maintains a small collection of single-header C libraries—notably stb_image.h for image loading, stb_truetype.h for font rasterization, and stb_vorbis.c for audio decoding—that are widely embedded across games, graphics applications, and multimedia software despite their narrow official product scope. The vendor's vulnerability footprint is concentrated in memory-safety issues characteristic of low-level image and audio parsing: out-of-bounds reads and writes, buffer boundary violations, double-free conditions, and integer overflows that arise from untrusted format handling. Because these libraries are distributed as headers and single-file implementations and are often integrated directly into shipped products without independent versioning, a single flaw in the upstream code can propagate to many downstream applications and devices. Defenders should inventory products that link these libraries rather than tracking Nothings as a vendor alone, and prioritize patches for internet-facing image or audio processing surfaces; live severity and exploitation counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Nothings over time
Signals from CVEs in this vendor scope (42 CVEs).
42 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-5317HIGH A security flaw has been discovered in Nothings stb up to 1.22. This affects the function start_decoder of the file stb_vorbis.c. The manipulation results in out-of-bounds write. T | Apr 2, 2026 | 8.8 | 29 | NO | NO |
CVE-2026-5315HIGH A vulnerability was determined in Nothings stb up to 1.26. The affected element is the function stbtt__buf_get8 in the library stb_truetype.h of the component TTF File Handler. Exe | Apr 2, 2026 | 8.8 | 29 | NO | NO |
CVE-2022-28042HIGH stb_image.h v2.27 was discovered to contain an heap-based use-after-free via the function stbi__jpeg_huff_decode. | Apr 15, 2022 | 8.8 | 29 | NO | NO |
CVE-2023-47212CRITICAL A heap-based buffer overflow vulnerability exists in the comment functionality of stb _vorbis.c v1.22. A specially crafted .ogg file can lead to an out-of-bounds write. An attacker | May 1, 2024 | 9.8 | 28 | NO | NO |
CVE-2026-5314HIGH A vulnerability was found in Nothings stb up to 1.26. Impacted is the function stbtt_InitFont_internal in the library stb_truetype.h of the component TTF File Handler. Performing a | Apr 1, 2026 | 8.8 | 27 | NO | NO |
CVE-2023-45666CRITICAL stb_image is a single file MIT licensed library for processing images. It may look like `stbi__load_gif_main` doesn’t give guarantees about the content of output value `*delays` u | Oct 21, 2023 | 9.8 | 27 | NO | NO |
CVE-2020-6620HIGH stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_get8. | Jan 8, 2020 | 8.8 | 27 | NO | NO |
CVE-2019-19777HIGH stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has a heap-based buffer over-read in stbi__load_main. | Dec 13, 2019 | 8.8 | 27 | NO | NO |
CVE-2018-16981HIGH stb stb_image.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer overflow in the stbi__out_gif_code function. | Sep 12, 2018 | 8.8 | 27 | NO | NO |
CVE-2020-6622HIGH stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_peek8. | Jan 8, 2020 | 8.8 | 26 | NO | NO |
Signals from CVEs in this vendor scope (42 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Nothings.
Media articles that mention a CVE ID that affects a product developed by Nothings — matched by CVE ID, not by vendor name.