CVE-2018-16981
stb stb_image.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer...
8.8 HighFix available
stb stb_image.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer overflow in the stbi__out_gif_code function.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
1.59%Up 1.2 points since Apr 14, 2021
What each source reports
NVD Score used
stb stb_image.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer overflow in the stbi__out_gif_code function.
- Record
CVE-2018-16981- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
stb stb_image.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer overflow in the stbi__out_gif_code function.
- Record
CVE-2018-16981- Updated
- 2026-11-02
EUVDEUVD-2018-8767 No score
stb stb_image.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer overflow in the stbi__out_gif_code function.
- Record
EUVD-2018-8767- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5p8c-xff7-r336
stb stb_image.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer...
stb stb_image.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer overflow in the stbi__out_gif_code function.
- Record
GHSA-5p8c-xff7-r336- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
stb stb_image.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer overflow in the stbi__out_gif_code function.
- Record
CVE-2018-16981- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-16981
stb stb_image.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer overflow in the stbi__out_gif_code function.
- Record
DEBIAN-CVE-2018-16981- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-16981
stb stb_image.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer overflow in the stbi__out_gif_code function.
- Record
UBUNTU-CVE-2018-16981- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUSN-7913-1 No score
mame vulnerabilities
It was discovered that the stb library, included in MAME, had a heap-based buffer overflow. An attacker could possibly use this issue to crash the program or execute arbitrary code. (CVE-2018-16981)
It was discovered that the tinyexr library, included in MAME, had a heap- based buffer over-read in the function DecodePixelData. An attacker could possibly use this issue to expose sensitive information or crash the program. (CVE-2022-34300)
It was discovered that the expat library, included in MAME, had an integer-overflow in the function doProlog. An attacker could possibly use this issue to crash the program or execute arbitrary code. (CVE-2021-46143)
- Record
USN-7913-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libstbDebian:12 |
before 0.0~git20190617.5.c72a95d-1 | 0.0~git20190617.5.c72a95d-1 |
libstbDebian:13 |
before 0.0~git20190617.5.c72a95d-1 | 0.0~git20190617.5.c72a95d-1 |
libstbDebian:14 |
before 0.0~git20190617.5.c72a95d-1 | 0.0~git20190617.5.c72a95d-1 |
libstbDebian:10 |
before 0.0~git20180212.15.e6afb9c-1+deb10u1, plus listed versions 0.0~git20180212.15.e6afb9c-1 |
0.0~git20180212.15.e6afb9c-1+deb10u1 |
libsfmlUbuntu:16.04:LTS |
All versions, plus listed versions 2.3.2+dfsg-1 |
None known |
libsixelUbuntu:16.04:LTS |
All versions, plus listed versions 1.4.2-11.5.2-2 |
None known |
loveUbuntu:16.04:LTS |
All versions, plus listed versions 0.9.1-3ubuntu1 |
None known |
mameUbuntu:16.04:LTS |
All versions, plus listed versions 0.160-0ubuntu1 |
None known |
zam-pluginsUbuntu:16.04:LTS |
All versions, plus listed versions 3.5~repack0-7build13.6~repack2-3 |
None known |
zynaddsubfxUbuntu:16.04:LTS |
All versions, plus listed versions 2.5.1-22.5.2-22.5.2-2ubuntu1 |
None known |
Show 74 moreShow less
| Package | Affected | Fixed |
|---|---|---|
catimgUbuntu:18.04:LTS |
All versions, plus listed versions 2.4.0-1 |
None known |
goxelUbuntu:18.04:LTS |
All versions, plus listed versions 0.7.1-20.7.2-1 |
None known |
libsfmlUbuntu:18.04:LTS |
All versions, plus listed versions 2.4.2+dfsg-4 |
None known |
libsixelUbuntu:18.04:LTS |
All versions, plus listed versions 1.5.2-21.7.3-1 |
None known |
loveUbuntu:18.04:LTS |
All versions, plus listed versions 0.9.1-4ubuntu1 |
None known |
mameUbuntu:Pro:18.04:LTS |
before 0.195+dfsg.1-2ubuntu0.1~esm1, plus listed versions 0.188+dfsg.1-0ubuntu20.189+dfsg.1-10.192+dfsg.1-0ubuntu10.195+dfsg.1-2 |
0.195+dfsg.1-2ubuntu0.1~esm1 |
retroarchUbuntu:18.04:LTS |
All versions, plus listed versions 1.4.1+dfsg1-1 |
None known |
zam-pluginsUbuntu:18.04:LTS |
All versions, plus listed versions 3.8~repack2-13.9~repack3-1 |
None known |
zynaddsubfxUbuntu:18.04:LTS |
All versions, plus listed versions 3.0.2-13.0.3-1 |
None known |
catimgUbuntu:20.04:LTS |
All versions, plus listed versions 2.5.0-1 |
None known |
ccextractorUbuntu:20.04:LTS |
All versions, plus listed versions 0.87+ds1-1 |
None known |
goxelUbuntu:20.04:LTS |
All versions, plus listed versions 0.8.1-10.8.1-1build1 |
None known |
libsfmlUbuntu:20.04:LTS |
All versions, plus listed versions 2.5.1+dfsg-12.5.1+dfsg-1build1 |
None known |
libsixelUbuntu:20.04:LTS |
All versions, plus listed versions 1.8.2-11.8.2-2.1 |
None known |
loveUbuntu:20.04:LTS |
All versions, plus listed versions 11.1-211.3-1 |
None known |
mameUbuntu:Pro:20.04:LTS |
before 0.220+dfsg.1-1ubuntu0.1~esm1, plus listed versions 0.206+dfsg.1-10.214+dfsg.1-20.215+dfsg.1-10.217+dfsg.1-10.217+dfsg.1-1build10.218+dfsg.1-10.220+dfsg.1-1 |
0.220+dfsg.1-1ubuntu0.1~esm1 |
renderdocUbuntu:20.04:LTS |
All versions, plus listed versions 1.4+dfsg-11.5+dfsg-11.5+dfsg-21.6+dfsg-11.6+dfsg-1build11.6+dfsg-1build2 |
None known |
retroarchUbuntu:20.04:LTS |
All versions, plus listed versions 1.7.3+dfsg1-1build11.7.3+dfsg1-1.1 |
None known |
tweenyUbuntu:20.04:LTS |
All versions, plus listed versions 3-13-2 |
None known |
zam-pluginsUbuntu:20.04:LTS |
All versions, plus listed versions 3.9~repack3-13.9~repack3-1build1 |
None known |
zynaddsubfxUbuntu:20.04:LTS |
All versions, plus listed versions 3.0.5-23.0.5-2build1 |
None known |
catimgUbuntu:22.04:LTS |
All versions, plus listed versions 2.7.0-1 |
None known |
ccextractorUbuntu:22.04:LTS |
All versions, plus listed versions 0.88+ds1-10.93+ds2-10.93+ds2-1ubuntu10.93+ds2-2 |
None known |
goxelUbuntu:22.04:LTS |
All versions, plus listed versions 0.10.6-30.10.8-1 |
None known |
libsfmlUbuntu:22.04:LTS |
All versions, plus listed versions 2.5.1+dfsg-1build12.5.1+dfsg-2 |
None known |
libsixelUbuntu:22.04:LTS |
All versions, plus listed versions 1.8.6-21.10.3-21.10.3-3 |
None known |
loveUbuntu:22.04:LTS |
All versions, plus listed versions 11.3-1 |
None known |
renderdocUbuntu:22.04:LTS |
All versions, plus listed versions 1.11+dfsg-51.15+dfsg-11.16+dfsg-11.16+dfsg-1build11.18+dfsg-1 |
None known |
retroarchUbuntu:22.04:LTS |
All versions, plus listed versions 1.7.3+dfsg1-1.1build1 |
None known |
tweenyUbuntu:22.04:LTS |
All versions, plus listed versions 3-2 |
None known |
zam-pluginsUbuntu:22.04:LTS |
All versions, plus listed versions 3.14~repack3-1 |
None known |
zynaddsubfxUbuntu:22.04:LTS |
All versions, plus listed versions 3.0.5-2build1 |
None known |
mameUbuntu:Pro:22.04:LTS |
before 0.242+dfsg.1-1ubuntu0.1~esm1, plus listed versions 0.235+dfsg.1-1ubuntu10.237+dfsg.1-10.238+dfsg.1-10.239+dfsg.1-10.240+dfsg.1-10.242+dfsg.1-1 |
0.242+dfsg.1-1ubuntu0.1~esm1 |
catimgUbuntu:24.04:LTS |
All versions, plus listed versions 2.7.0-2 |
None known |
ccextractorUbuntu:24.04:LTS |
All versions, plus listed versions 0.94+ds1-30.94+ds1-3build20.94+ds1-3build3 |
None known |
goxelUbuntu:24.04:LTS |
All versions, plus listed versions 0.11.0-1.10.11.0-1.1build20.11.0-1.1build3 |
None known |
libsfmlUbuntu:24.04:LTS |
All versions, plus listed versions 2.5.1+dfsg-2build12.6.1+dfsg-22.6.1+dfsg-2build12.6.1+dfsg-2build2 |
None known |
libsixelUbuntu:24.04:LTS |
All versions, plus listed versions 1.10.3-31.10.3-3build1 |
None known |
loveUbuntu:24.04:LTS |
All versions, plus listed versions 11.4-111.5-111.5-1build1 |
None known |
tweenyUbuntu:24.04:LTS |
All versions, plus listed versions 3-2 |
None known |
zam-pluginsUbuntu:24.04:LTS |
All versions, plus listed versions 4.1+ds-24.1+ds-34.2+ds-14.2+ds-1build1 |
None known |
zynaddsubfxUbuntu:24.04:LTS |
All versions, plus listed versions 3.0.6-63.0.6-6build13.0.6-6build23.0.6-6build3 |
None known |
mameUbuntu:Pro:24.04:LTS |
before 0.264+dfsg.1-1ubuntu0.1~esm1, plus listed versions 0.257+dfsg.1-10.258+dfsg.1-1build10.261+dfsg.1-10.261+dfsg.1-1build20.261+dfsg.1-1build30.264+dfsg.1-1 |
0.264+dfsg.1-1ubuntu0.1~esm1 |
retroarchUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 1.14.0+dfsg-1build11.15.0+dfsg-11.16.0.3+dfsg-11.18.0+dfsg-11.18.0+dfsg-1ubuntu0.1~esm1 |
None known |
catimgUbuntu:25.10 |
All versions, plus listed versions 2.7.0-22.7.0-4 |
None known |
goxelUbuntu:25.10 |
All versions, plus listed versions 0.11.0-1.1build3 |
None known |
libsfmlUbuntu:25.10 |
All versions, plus listed versions 2.6.2+dfsg-2build1 |
None known |
libsixelUbuntu:25.10 |
All versions, plus listed versions 1.10.5-1 |
None known |
loveUbuntu:25.10 |
All versions, plus listed versions 11.5-2 |
None known |
mameUbuntu:25.10 |
before 0.277+dfsg.1-4ubuntu0.1, plus listed versions 0.275+dfsg.1-30.277+dfsg.1-4 |
0.277+dfsg.1-4ubuntu0.1 |
retroarchUbuntu:25.10 |
All versions, plus listed versions 1.20.0+dfsg-2build11.20.0+dfsg-2build21.20.0+dfsg-31.20.0+dfsg-3ubuntu0.1 |
None known |
tweenyUbuntu:25.10 |
All versions, plus listed versions 3-2 |
None known |
zam-pluginsUbuntu:25.10 |
All versions, plus listed versions 4.2+ds-1build1 |
None known |
zynaddsubfxUbuntu:25.10 |
All versions, plus listed versions 3.0.6-6build33.0.6-7 |
None known |
catimgUbuntu:26.10 |
All versions, plus listed versions 2.7.0-4.12.8.0-1 |
None known |
goxelUbuntu:26.10 |
All versions, plus listed versions 0.11.0-1.1build40.15.1-1ubuntu1 |
None known |
libsfmlUbuntu:26.10 |
All versions, plus listed versions 3.0.2+dfsg-23.1.0+dfsg-33.1.0+dfsg-4 |
None known |
libsixelUbuntu:26.10 |
All versions, plus listed versions 1.10.5-1build11:1.8.7-r2-1 |
None known |
loveUbuntu:26.10 |
All versions, plus listed versions 11.5-311.5-4 |
None known |
mameUbuntu:26.10 |
All versions, plus listed versions 0.285+dfsg1-10.287+dfsg1-10.288+dfsg1-10.289+dfsg1-1 |
None known |
retroarchUbuntu:26.10 |
All versions, plus listed versions 1.22.2+dfsg-2ubuntu1 |
None known |
tweenyUbuntu:26.10 |
All versions, plus listed versions 3-2.1 |
None known |
zam-pluginsUbuntu:26.10 |
All versions, plus listed versions 4.2+ds-1build2 |
None known |
zynaddsubfxUbuntu:26.10 |
All versions, plus listed versions 3.0.6-7.13.0.6-7.2 |
None known |
catimgUbuntu:26.04:LTS |
All versions, plus listed versions 2.7.0-42.7.0-4.1 |
None known |
goxelUbuntu:26.04:LTS |
All versions, plus listed versions 0.11.0-1.1build30.11.0-1.1build4 |
None known |
libsfmlUbuntu:26.04:LTS |
All versions, plus listed versions 2.6.2+dfsg-2build13.0.2+dfsg-13.0.2+dfsg-2 |
None known |
libsixelUbuntu:26.04:LTS |
All versions, plus listed versions 1.10.5-11.10.5-1build1 |
None known |
loveUbuntu:26.04:LTS |
All versions, plus listed versions 11.5-211.5-2build111.5-3 |
None known |
mameUbuntu:26.04:LTS |
All versions, plus listed versions 0.277+dfsg.1-40.281+dfsg1-10.281+dfsg1-1build10.284+dfsg1-10.285+dfsg1-1 |
None known |
retroarchUbuntu:26.04:LTS |
All versions, plus listed versions 1.20.0+dfsg-31.22.2+dfsg-11.22.2+dfsg-21.22.2+dfsg-2build11.22.2+dfsg-2ubuntu1 |
None known |
tweenyUbuntu:26.04:LTS |
All versions, plus listed versions 3-23-2.1 |
None known |
zam-pluginsUbuntu:26.04:LTS |
All versions, plus listed versions 4.2+ds-1build14.2+ds-1build2 |
None known |
zynaddsubfxUbuntu:26.04:LTS |
All versions, plus listed versions 3.0.6-73.0.6-7.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-16981 is a high vulnerability (CVSS 8.8) in Debian Linux, published September 12, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.59%, the 75th percentile. Fixed in libstb 0.0~git20190617.5.c72a95d-1.