Description

An out-of-bounds read in the stbsp_vsnprintf function (stb_sprintf.h) of nothings stb commit 31c1ad3 allows attackers to cause a Denial of Service (DoS) via sending a crafted input.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.0",
  "pubDate": "2026-09-09T21:17:04.530Z",
  "pubdate": "2026-09-09T21:17:04.530Z",
  "executiveSummary": "An out-of-bounds (OOB) read vulnerability exists in the stbsp_vsnprintf function within the stb_sprintf.h header file, specifically identified in commit 31c1ad3 of the nothings/stb repository.\nThe vulnerability occurs due to improper bounds checking when processing input strings, which can lead to memory access beyond the intended buffer limits.\nAn attacker can exploit this flaw by providing a specifically crafted input string to the affected function, resulting in a Denial of Service (DoS) condition.\nThis vulnerability poses a significant risk to applications utilizing this library for string formatting, particularly where untrusted input is processed.\nSuccessful exploitation causes the application to crash, thereby impacting system availability. No authentication or elevated privileges are required to initiate an attack, as the flaw is triggered directly via standard library usage.\nThe risk is primarily focused on service availability; however, in certain memory layouts, out-of-bounds reads may inadvertently leak sensitive stack or heap data, potentially assisting in further exploitation phases.",
  "technicalDetails": "The vulnerability resides within the stbsp_vsnprintf function, which is designed to perform formatted output conversion similarly to the standard vsnprintf function. The root cause is a failure to properly validate input length and handle specific format specifiers within the internal state machine of the stb_sprintf implementation.\nWhen processing a malformed or crafted format string, the logic fails to maintain strict adherence to buffer boundaries. This leads the function to perform read operations at memory offsets outside the allocated stack or heap buffers.\nThe attack flow begins when an application passes a user-supplied string—containing malicious format specifiers—to a function that utilizes stbsp_vsnprintf. Because the library does not adequately verify the boundaries during the parsing phase, it increments its internal pointer beyond the bounds of the provided data buffer.\nWhen the parser attempts to dereference these out-of-bounds memory addresses, the process triggers an access violation or segmentation fault. Because this read attempt often hits unmapped or protected memory regions, the runtime environment terminates the process, resulting in a Denial of Service.\nThis flaw affects the code base as of commit 31c1ad3. The exploitation does not require prior authentication or specialized privileges, as the vulnerability is inherent to the parsing logic of the library itself. If the application is exposed to external, untrusted input streams, the attack vector is effectively network-reachable.\nBeyond the immediate DoS impact, the OOB read may have secondary implications. If the read operation accesses memory that has been populated by other processes or sensitive threads, it may facilitate information disclosure by reading adjacent memory segments, which could be leveraged to bypass address space layout randomization (ASLR) or other memory protection mechanisms."
}