CyberRota Analysis
AI-GeneratedA heap buffer overflow vulnerability exists in the stb_vorbis library, specifically in the start_decoder() function, where the allocation size for codebook multiplicands is improperly truncated. This flaw allows attackers to create malicious Ogg Vorbis files that can lead to out-of-bounds writes, resulting in process crashes or heap corruption. Organizations utilizing stb_vorbis in their applications should prioritize patching this vulnerability to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook multiplicands allocation size is truncated from size_t to int. Attackers can craft a malicious Ogg Vorbis file with large entries and dimensions values to trigger out-of-bounds writes, causing process crashes or heap corruption.