CVE-2026-102804

6.5 MEDIUMpublic exploit available

Published 2026-09-30 · Updated 2026-09-30

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

A vulnerability was detected in Nothings stb up to 2c980bb59875b0d32144a71867fbdebb2f77cd20. The impacted element is the function hexwave_init in the library stb_hexwave.h. Performing a manipulation of the argument width/oversample results in integer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weaknesses

CWE-189, CWE-190

Public exploit & PoC references

https://github.com/nothings/stb/
https://github.com/nothings/stb/issues/1961
https://github.com/user-attachments/files/31351618/poc_hexwave.c

All references

https://github.com/nothings/stb/
https://github.com/nothings/stb/issues/1961
https://github.com/user-attachments/files/31351618/poc_hexwave.c
https://vuldb.com/cve/CVE-2026-102804
https://vuldb.com/submit/944861
https://vuldb.com/vuln/411496
https://vuldb.com/vuln/411496/cti

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2026-101279
LOWCVE-2026-102620PoC
LOWCVE-2026-102621PoC
MEDIUMCVE-2026-102805PoC
LOWCVE-2026-94030PoC
MEDIUMCVE-2025-14181PoC
HIGHCVE-2026-100208
HIGHCVE-2026-100889

Related by shared AI tags and CWE weakness class. Browse the full archive.