CVE-2019-15058 — stbi: heap-based buffer overflow in stbi__tga_load function in stb_image.h

Back Back to CVE browser

CRITICAL

stbi: heap-based buffer overflow in stbi__tga_load function in stb_image.h

Published Aug 14, 2019

9.1

CRITICAL

CVSS 3.1

EPSS 2.80%

Description

stb_image.h (aka the stb image loader) 2.23 has a heap-based buffer over-read in stbi__tga_load, leading to Information Disclosure or Denial of Service.

Affected products

Red Hat Enterprise Linux 6

clutter

Out of support scope
Red Hat Enterprise Linux 7

cogl

Not affected
Red Hat Enterprise Linux 7

compat-cogl114

Not affected
Red Hat Enterprise Linux 8

SFML

Not affected
Red Hat Enterprise Linux 8

cogl

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	clutter	Out of support scope	n/a
Red Hat Enterprise Linux 7	cogl	Not affected	n/a
Red Hat Enterprise Linux 7	compat-cogl114	Not affected	n/a
Red Hat Enterprise Linux 8	SFML	Not affected	n/a
Red Hat Enterprise Linux 8	cogl	Not affected	n/a

Remediation

Red Hat statement

The versions of stbi embedded in Red Hat products do not contain the vulnerable code and therefore they are not affected by this flaw.

Metrics

2.80% 0.02796

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.02796

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Table of values (15 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	2.80% (0.02796)	85.97th	v5 (v2026.06.15)
Jun 15, 2026	2.80% (0.02796)	84.53th	v5 (v2026.06.15)
Mar 30, 2025	1.19% (0.01186)	76.87th	v4 (v2025.03.14)
Mar 29, 2025	3.02% (0.03024)	77.66th	v4 (v2025.03.14)
Jul 20, 2024	0.89% (0.00888)	82.77th	v3 (v2023.03.01)
May 22, 2024	0.89% (0.00888)	82.58th	v3 (v2023.03.01)
Sep 3, 2023	0.89% (0.00888)	80.57th	v3 (v2023.03.01)
Mar 7, 2023	0.65% (0.00653)	76.27th	v3 (v2023.03.01)
Mar 6, 2023	1.11% (0.01108)	55.18th	v2 (v2022.01.01)
Apr 1, 2022	1.11% (0.01108)	51.54th	v2 (v2022.01.01)
Feb 4, 2022	12.30% (0.12300)	89.42th	v2 (v2022.01.01)
Feb 3, 2022	7.62% (0.07623)	84.03th	v1
Jan 6, 2022	7.62% (0.07623)	83.88th	v1
Jan 5, 2022	1.81% (0.01806)	75.23th	v5 (v2026.06.15)
Apr 14, 2021	1.81% (0.01806)	0.00th	v1

Weaknesses (2)

CWE-122

CWE-125

Out-of-bounds Read

References (10)

https://access.redhat.com/security/cve/CVE-2019-15058
Vendor Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=934973
x_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=1816324
Issue Tracking
https://github.com/nothings/stb/issues/790
x_refsource_MISCExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-15058
https://security-tracker.debian.org/tracker/CVE-2019-15058
x_refsource_CONFIRM
https://www.cve.org/CVERecord?id=CVE-2019-15058
https://www.cvedetails.com/cve/CVE-2019-15058/
x_refsource_MISC
https://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg1695025.html
mailing-listx_refsource_MLIST
https://www.suse.com/security/cve/CVE-2019-15058/
x_refsource_MISC

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2019-15058		Vendor Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=934973		x_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=1816324		Issue Tracking
https://github.com/nothings/stb/issues/790		x_refsource_MISCExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-15058
https://security-tracker.debian.org/tracker/CVE-2019-15058		x_refsource_CONFIRM
https://www.cve.org/CVERecord?id=CVE-2019-15058
https://www.cvedetails.com/cve/CVE-2019-15058/		x_refsource_MISC
https://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg1695025.html		mailing-listx_refsource_MLIST
https://www.suse.com/security/cve/CVE-2019-15058/		x_refsource_MISC