Out-of-Bounds Read Vulnerability in Nothings stb Header Array Handler

CVE-2025-3406

What is CVE-2025-3406?

A vulnerability exists in the Nothings stb, specifically in the stbhw_build_tileset_from_image function of the Header Array Handler. This issue allows for an out-of-bounds read due to improper handling of the width argument, potentially leading to data leakage or unauthorized access to sensitive information. The vulnerability can be exploited remotely, and because Nothings utilizes a rolling release model, specific version details of affected or patched releases are not disclosed. Nothings has not responded to early disclosures regarding this security concern.

References