Is CVE-2026-5186 actively exploited?

No active exploitation of CVE-2026-5186 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-5186 be exploited remotely?

No. CVE-2026-5186 requires local access to exploit.

What is the CVSS score of CVE-2026-5186?

CVE-2026-5186 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-5186

MEDIUM

CVE-2026-5186

CWE-119Published: March 31, 2026· Updated: Apr 1, 2026

5.3

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:1.6th

Official Description

A weakness has been identified in Nothings stb up to 2.30. This impacts the function stbi__load_gif_main of the file stb_image.h of the component Multi-frame GIF File Handler. This manipulation causes double free. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

NVD Source

Technical Analysis

CVE-2026-5186 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

From a weakness classification perspective (CWE-119): Buffer overflow vulnerabilities can lead to arbitrary code execution or denial of service by corrupting adjacent memory.