High severity · published Apr 8, 2025
CVE-2025-3408
Nothings stb stb_dupreplace integer overflow
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability was found in Nothings stb up to f056911. It has been rated as critical. Affected by this issue is the function stb_dupreplace. The manipulation leads to integer overflow. The attack may be launched remotely. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ST
stb · Nothings
f056911 · source: vendor
SI
Stb Image.h · Nothings
through 2.13 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-3408
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-3408
Permissions Required
https://vuldb.com/?ctiid.303686
Third Party Advisory
https://vuldb.com/?id.303686
Third Party Advisory
https://vuldb.com/?submit.544230
More from stb
8.8
CVE-2026-5317
Nothings stb stb_vorbis.c start_decoder out-of-bounds write
8.8
CVE-2026-5315
Nothings stb TTF File stb_truetype.h stbtt__buf_get8 out-of-bounds
8.8
CVE-2026-5314
Nothings stb TTF File stb_truetype.h stbtt_InitFont_internal out-of-bounds
8.8
CVE-2025-3409
Nothings stb stb_include_string stack-based overflow
8.8
CVE-2025-3407
Nothings stb stbhw_build_tileset_from_image out-of-bounds