CVE-2021-42715: Debian Linux

Medium severity, CVSS 5.5. EPSS: 1.3% chance of exploitation in the next 30 days.

An issue was discovered in stb stb_image.h 1.33 through 2.27. The HDR loader parsed truncated end-of-file RLE scanlines as an infinite sequence of zero-length runs. An attacker could potentially have caused denial of service in applications using stb_image by submitting crafted HDR files.

Affected products

• Debian Debian Linux: version 10.0 only
• Fedoraproject Fedora: version 33 only; version 34 only; version 35 only
• Nothings Stb Image.h: from 1.33, up to and including 2.27

Published 2021-10-21. Last modified 2026-06-17.