CVE-2026-102804

Katalog CVE

CVSS 6.5 · Medium EPSS 0,35%

Kerentanan Numeric Errors. Skor CVSS 3.1 6.5 (Medium) menurut vuldb.com.

Deskripsi (NVD)

A vulnerability was detected in Nothings stb up to 2c980bb59875b0d32144a71867fbdebb2f77cd20. The impacted element is the function hexwave_init in the library stb_hexwave.h. Performing a manipulation of the argument width/oversample results in integer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Rincian

Terbit di NVD

30 September 2026

Terakhir diubah

2 Oktober 2026

Status NVD

Deferred

CVSS 3.1

6.5 (Medium), sumber vuldb.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-189: Numeric Errors
CWE-190: Integer Overflow or Wraparound

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,4% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/nothings/stb/
• https://github.com/nothings/stb/issues/1961
• https://github.com/user-attachments/files/31351618/poc_hexwave.c
• https://vuldb.com/cve/CVE-2026-102804
• https://vuldb.com/submit/944861
• https://vuldb.com/vuln/411496
• https://vuldb.com/vuln/411496/cti