Heap-based Buffer Overflow in Nothings stb_image Multi-frame GIF Handler

CVE-2026-5185

What is CVE-2026-5185?

A security vulnerability has been identified in Nothings stb_image, specifically in the Multi-frame GIF File Handler function subroutine stbi__gif_load_next within stb_image.h. This flaw may lead to a heap-based buffer overflow when processing GIF files, posing a significant risk during local execution. As the vulnerability is publicly exploitable, users are urged to review their usage of the affected versions and consider mitigating measures. Reports indicate the vendor has not responded to early notifications regarding this issue.

References