CVE-2026-79516: stb_sprintf.h Out-of-Bounds Read DoS Vulnerability

CVE-2026-79516 Overview

CVE-2026-79516 is an out-of-bounds read vulnerability in the stbsp_vsnprintf function within stb_sprintf.h, part of the widely used single-file nothings/stb C header library. The flaw exists in commit 31c1ad3 and allows a local attacker to trigger a Denial of Service (DoS) by supplying a crafted input to applications that link against the affected code. Because stb_sprintf is embedded directly into thousands of downstream projects, remediation depends on each consuming application updating its bundled copy.

Critical Impact
A crafted format string or argument passed to stbsp_vsnprintf reads memory outside intended bounds, causing process crashes and loss of availability for applications that expose the function to attacker-influenced input.

Affected Products

nothings/stb — stb_sprintf.h at commit 31c1ad3
Downstream applications embedding the affected stb_sprintf.h header
Software using stbsp_vsnprintf to process untrusted format inputs

Discovery Timeline

2026-09-09 - CVE-2026-79516 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-79516

Vulnerability Analysis

The vulnerability resides in stbsp_vsnprintf, the core formatted-print routine implemented in stb_sprintf.h. When the function processes a crafted format specifier or argument list, its internal parsing logic reads bytes beyond the boundary of a source buffer. The out-of-bounds read can dereference unmapped memory pages, resulting in a segmentation fault and immediate process termination.

Exploitation requires local access and elevated attack complexity, and the flaw does not provide code execution or confidentiality impact. The primary consequence is availability loss for any long-running service, command-line tool, or game engine that funnels attacker-controlled data into stbsp_vsnprintf.

Because stb libraries are distributed as vendored source rather than as a shared library, a single upstream fix does not automatically propagate. Each project that copied stb_sprintf.h at or around commit 31c1ad3 must be independently patched.

Root Cause

The root cause is missing or insufficient bounds validation inside the format-string parser of stbsp_vsnprintf. Certain input sequences cause the parser to advance a read pointer past the terminating byte of the source buffer without checking length constraints, classifying the defect as an out-of-bounds read.

Attack Vector

An attacker with local access supplies a crafted input, such as a malformed format string or oversized numeric argument, to any program that forwards data into stbsp_vsnprintf. Processing the input triggers the out-of-bounds read and crashes the consuming process. See the GitHub issue discussion for reproduction details.

// No verified proof-of-concept code is published for CVE-2026-79516.
// Refer to the upstream GitHub issue for reproduction details.

Detection Methods for CVE-2026-79516

Indicators of Compromise

Unexpected SIGSEGV or access-violation crashes in processes that link stb_sprintf.h
Core dumps whose faulting instruction resides inside stbsp_vsnprintf or its inlined helpers
Repeated crash-restart cycles of a service immediately after receiving untrusted user input

Detection Strategies

Inventory source trees and container images for copies of stb_sprintf.h and compare against commit 31c1ad3
Enable AddressSanitizer (ASan) builds in test pipelines to surface the out-of-bounds read during fuzzing of format inputs
Correlate application crash telemetry with recent input events to identify DoS attempts against affected binaries

Monitoring Recommendations

Forward operating-system crash logs and systemd-coredump events to a centralized logging platform for review
Alert on abnormal restart rates for services known to embed stb_sprintf
Track dependency manifests and vendored headers in CI to detect reintroduction of the vulnerable commit

How to Mitigate CVE-2026-79516

Immediate Actions Required

Identify all internal and third-party components that vendor stb_sprintf.h and confirm the commit hash in use
Restrict local access to processes that call stbsp_vsnprintf with attacker-influenced data until patched
Validate and length-check any input that reaches stbsp_vsnprintf, including format strings and variadic arguments

Patch Information

No formal versioned release exists for stb_sprintf; the library is distributed as a single header updated in place. Consult the upstream GitHub issue to track the fix commit and replace stb_sprintf.h in each dependent project once an updated header is published.

Workarounds

Refuse untrusted format strings and only pass fixed, developer-controlled format specifiers to stbsp_vsnprintf
Replace stbsp_vsnprintf with the platform vsnprintf implementation where compatibility permits
Run affected services under a process supervisor with rate-limited restarts to reduce DoS impact

bash

# Locate vulnerable copies of stb_sprintf.h across a source tree
grep -rn "stbsp_vsnprintf" ./ --include="*.h" --include="*.c" --include="*.cpp"
find . -name "stb_sprintf.h" -exec sha1sum {} \;