CVE-2026-5316CWE-400CWE-770

Nothings stb stb_vorbis.c setup_free allocation of resources

Medium · published April 2, 2026

CVSS v4.0
5.3
EPSS
1%
Percentile
53.2
In the wild
Unconfirmed
What it is

A vulnerability was identified in Nothings stb up to 1.22. The impacted element is the function setup_free of the file stb_vorbis.c. The manipulation leads to allocation of resources. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00716 · 53.2th percentile
Weaknesses
CWE-400 · Uncontrolled Resource Consumption; CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-04-02T00:00Z
EPSS history
Timeline
  • 02 APR 00:00Z
    Nothings stb stb_vorbis.c setup_free allocation of resources
    cvelistv5