CVE-2025-3409

Name of the Vulnerable Software and Affected Versions: Nothings stb up to f056911

Description: A critical vulnerability has been found in Nothings stb, affecting the stb include string function. The manipulation of the path to includes argument leads to a stack-based buffer overflow. This issue can be exploited remotely. The vendor was contacted about this disclosure but did not respond.

Recommendations: For Nothings stb up to f056911, as a temporary workaround, consider disabling the stb include string function until a patch is available. Restrict access to the path to includes argument to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.