Hi,

The following vulnerability was published for libstb.

CVE-2026-5186[0]:
| A weakness has been identified in Nothings stb up to 2.30. This
| impacts the function stbi__load_gif_main of the file stb_image.h of
| the component Multi-frame GIF File Handler. This manipulation causes
| double free. The attack requires local access. The exploit has been
| made available to the public and could be used for attacks. The
| vendor was contacted early about this disclosure but did not respond
| in any way.

https://vuldb.com/submit/780395 claims this was reported upstream, but
there's no public issue or similar.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-5186
https://www.cve.org/CVERecord?id=CVE-2026-5186

Please adjust the affected versions in the BTS as needed.