Executive brief
stb_vorbis is a popular single-file audio decoding library used in many applications to play Ogg Vorbis audio files. A heap buffer overflow vulnerability in the decoder can be triggered by a malicious audio file, potentially causing the application to crash or allowing attackers to corrupt memory and execute arbitrary code.
Technical details
The vulnerability is a heap buffer overflow in the start_decoder() function where the codebook multiplicands allocation size is truncated from size_t to int. Attackers can craft a malicious Ogg Vorbis file with large entries and dimensions values to trigger out-of-bounds writes. The vulnerability is reachable by processing any untrusted Ogg Vorbis file without special preconditions. Successful exploitation can result in process crashes or heap memory corruption, potentially leading to code execution. Patches are available from the stb repository.
Affected products
- stb stb_vorbis through 1.22
Timeline
- 2026-09-12: disclosed