stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook multiplicands allocation size is truncated from size_t to int. Attackers can craft a malicious Ogg Vorbis file with large entries and dimensions values to trigger out-of-bounds writes, causing process crashes or heap corruption.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
Low
Partial data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Stb_Vorbis_Project Stb_Vorbis
cpe:2.3:a:stb_vorbis_project:stb_vorbis:*:*:*:*:*:*:*:*
|
— |
<= 1.22
|
References 7
https://github.com/nothings/stb
disclosure@vulncheck.com
https://github.com/nothings/stb/blob/2c980bb59875b0d32144a71867fbdebb2f77cd20/s…
disclosure@vulncheck.com
https://github.com/nothings/stb/blob/2c980bb59875b0d32144a71867fbdebb2f77cd20/s…
disclosure@vulncheck.com
https://github.com/nothings/stb/issues/1928
disclosure@vulncheck.com
https://github.com/nothings/stb/issues/1933
disclosure@vulncheck.com
https://github.com/nothings/stb/issues/1947
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/stb-vorbis-through-1.22-heap-buffer-overfl…
disclosure@vulncheck.com