# CVE-2026-102804: nothings stb integer overflow in hexwave_init

Source: https://junglewise.ai/threats/cve-2026-102804-a-vulnerability-was-detected-in-nothings-stb-up-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-102804 · Severity: medium · CVSS 6.5 · Published 2026-09-30

nothings stb is a single-file C library for audio waveform synthesis. An integer overflow in the hexwave_init function allows attackers to craft specially-sized parameters that cause buffer overflows when the library allocates undersized buffers and then writes far beyond their bounds. This can lead to memory corruption and potential code execution if an application exposes the width and oversample parameters to untrusted input.

Technologies: [Nothings Stb](https://junglewise.ai/threats/technologies/stb). Vendors: [Nothings](https://junglewise.ai/threats/vendors/nothings).

## Quick answers

**Is CVE-2026-102804 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102804 being exploited in the wild.

**How severe is CVE-2026-102804?** Medium severity, with a CVSS score of 6.5, published 30 September 2026.

**Which products and versions are affected?** Nothings Stb up to commit 2c980bb59875b0d32144a71867fbdebb2f77cd20.

**Is there a fix for CVE-2026-102804?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-102804 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-102804?** Check whether you run Nothings Stb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an integer overflow in stb_hexwave.h's hexwave_init function where multiplying user-controlled width and oversample parameters (line 560) overflows a 32-bit int, resulting in undersized heap or stack buffer allocations. The deinterleave loops (lines 611-612) then write millions of 32-bit values past the end of these buffers without bounds checking. No fix has been released; the project maintainers have not responded to the public disclosure.

## Affected products

- nothings stb up to commit 2c980bb59875b0d32144a71867fbdebb2f77cd20

## Timeline

- 2026-06-06: disclosed: Public GitHub issue #1961 opened with full technical details and proof-of-concept code
- 2026-09-30: other: CVE-2026-102804 published on NVD

## References

- [https://github.com/nothings/stb/](https://github.com/nothings/stb/)
- [https://github.com/nothings/stb/issues/1961](https://github.com/nothings/stb/issues/1961)

## Related threats

- [stb image integer overflow in PNG/JPEG/TGA encoding](https://junglewise.ai/threats/cve-2026-102805-a-flaw-has-been-found-in-nothings-stb-up-to-1-16-this-affects)
- [stb out-of-bounds write in stbsp_vsnprintf](https://junglewise.ai/threats/cve-2026-79516-stb-out-of-bounds-write-in-stbsp-vsnprintf)
- [nothings stb out-of-bounds read in TrueType glyph parsing](https://junglewise.ai/threats/cve-2026-79515-nothings-stb-out-of-bounds-read-in-truetype-glyph-parsing)