https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-3409.htmlhttps://patchthecve.com/cve/CVE-2025-3409.htmlWed, 17 Jun 2026 09:19:54 +0000MEDIUM 6.3: A vulnerability classified as critical has been found in Nothings stb up to f056911. This affects the function stb_include_string. The manipulation of the argument path_to_includes leads to stack-based buffer overflow. It is possible to initiate the attack remotely. This product does not use versionhttps://patchthecve.com/cve/CVE-2025-3408.htmlhttps://patchthecve.com/cve/CVE-2025-3408.htmlWed, 17 Jun 2026 09:19:54 +0000MEDIUM 6.3: A vulnerability was found in Nothings stb up to f056911. It has been rated as critical. Affected by this issue is the function stb_dupreplace. The manipulation leads to integer overflow. The attack may be launched remotely. Continious delivery with rolling releases is used by this product. Thereforehttps://patchthecve.com/cve/CVE-2025-3407.htmlhttps://patchthecve.com/cve/CVE-2025-3407.htmlWed, 17 Jun 2026 09:19:54 +0000MEDIUM 6.3: A vulnerability was found in Nothings stb up to f056911. It has been declared as critical. Affected by this vulnerability is the function stbhw_build_tileset_from_image. The manipulation of the argument h_count/v_count leads to out-of-bounds read. The attack can be launched remotely. This product tahttps://patchthecve.com/cve/CVE-2025-3406.htmlhttps://patchthecve.com/cve/CVE-2025-3406.htmlWed, 17 Jun 2026 09:19:54 +0000MEDIUM 4.3: A vulnerability was found in Nothings stb up to f056911. It has been classified as problematic. Affected is the function stbhw_build_tileset_from_image of the component Header Array Handler. The manipulation of the argument w leads to out-of-bounds read. It is possible to launch the attack remotely.