CVE record
CVE-2025-3409
A vulnerability classified as critical has been found in Nothings stb up to f056911. This affects the function stb_include_string. The manipulation of the argument path_to_includes leads to stack-based buffer overflow. It is possible to initiate the attack remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
Amazon picks for vulnerability response
Product discovery links are localized to Amazon US when country data is available.
This page may contain affiliate links. We may earn a commission at no extra cost to you. As an Amazon Associate I earn from qualifying purchases.
Hardware security keys
Physical MFA keys for admin accounts, cloud consoles, password managers, and incident response workflows.
Security engineering books
Books on secure design, incident response, threat modeling, cloud security, and practical defense.
Ethernet cable testers
Portable testers for validating office, rack, home lab, and troubleshooting cable runs.
Vulnerability metadata
- Published
- 2025-04-07T23:45:40.050Z
- Modified
- 2026-05-19T16:47:10.083Z
- EPSS
- Not available
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Recommended platforms
Affiliate-supported recommendations for CVE-2025-3409 vulnerability response.
This page may contain affiliate links. We may earn a commission at no extra cost to you. As an Amazon Associate I earn from qualifying purchases.
Security engineering books
Browse practical security, incident response, cloud security, and secure coding books for team learning.
Cloud security platform
Continuously review cloud posture, exposed services, identity risks, and misconfigurations.
Monitoring and incident response
Track uptime, logs, traces, TLS expiry, API latency, and production security signals.