CVE-2019-20056
stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has an...
CVE-2019-20056 is a medium vulnerability (CVSS 6.5) in Nothings Stb Image.h, published December 29, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.94%, the 60th percentile. Fixed in libsixel 1.8.6-1.
stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has an assertion failure in stbi__shiftsigned.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has an assertion failure in stbi__shiftsigned.
- Record
CVE-2019-20056- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-617
- Updated
- 2026-11-02
CVE List No score
stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has an assertion failure in stbi__shiftsigned.
- Record
CVE-2019-20056- Updated
- 2026-11-02
EUVDEUVD-2019-10612 No score
stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has an assertion failure in stbi__shiftsigned.
- Record
EUVD-2019-10612- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f76f-ffcv-7fmm No score
stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has an...
stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has an assertion failure in stbi__shiftsigned.
- Record
GHSA-f76f-ffcv-7fmm- Updated
- 2026-11-02
OSV
stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has an assertion failure in stbi__shiftsigned.
- Record
CVE-2019-20056- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-20056
stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has an assertion failure in stbi__shiftsigned.
- Record
DEBIAN-CVE-2019-20056- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-20056
stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has an assertion failure in stbi__shiftsigned.
- Record
UBUNTU-CVE-2019-20056- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libsixelDebian:12 |
before 1.8.6-1 | 1.8.6-1 |
libsixelDebian:13 |
before 1.8.6-1 | 1.8.6-1 |
libsixelDebian:14 |
before 1.8.6-1 | 1.8.6-1 |
libstbDebian:12 |
before 0.0~git20220908.8b5f1f3+ds-1 | 0.0~git20220908.8b5f1f3+ds-1 |
libstbDebian:13 |
before 0.0~git20220908.8b5f1f3+ds-1 | 0.0~git20220908.8b5f1f3+ds-1 |
libstbDebian:14 |
before 0.0~git20220908.8b5f1f3+ds-1 | 0.0~git20220908.8b5f1f3+ds-1 |
libsixelUbuntu:16.04:LTS |
All versions, plus listed versions 1.4.2-11.5.2-2 |
None known |
libsixelUbuntu:18.04:LTS |
All versions, plus listed versions 1.5.2-21.7.3-1 |
None known |
libsixelUbuntu:20.04:LTS |
All versions, plus listed versions 1.8.2-11.8.2-2.1 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |