Description

stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook multiplicands allocation size is truncated from size_t to int. Attackers can craft a malicious Ogg Vorbis file with large entries and dimensions values to trigger out-of-bounds writes, causing process crashes or heap corruption.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-09-12T00:17:06.440Z",
  "pubdate": "2026-09-12T00:17:06.440Z",
  "executiveSummary": "stb_vorbis through version 1.22 is susceptible to a heap-based buffer overflow vulnerability residing within the start_decoder() function.\nThe vulnerability stems from an integer truncation issue occurring during the allocation of codebook multiplicands, where a size_t value is improperly cast to a signed int.\nBy crafting a malicious Ogg Vorbis file containing specific large entries and dimensions, an attacker can induce an out-of-bounds heap write.\nThe impact of this vulnerability includes potential process crashes, denial of service (DoS), or arbitrary heap corruption, which may facilitate further exploitation scenarios such as remote code execution depending on the host application's memory layout and security posture.\nSuccessful exploitation requires the victim to process a specifically formatted, attacker-controlled Ogg Vorbis audio file.\nThis vulnerability represents a significant security risk for software products that integrate the stb_vorbis library for multimedia decoding, as it impacts the integrity and availability of the host application.",
  "technicalDetails": "The vulnerability is rooted in an integer truncation flaw within the start_decoder() function of the stb_vorbis library. During the parsing of Ogg Vorbis files, the decoder attempts to allocate memory for codebook multiplicands. The calculation of the required memory size involves parameters derived from the file headers, specifically 'entries' and 'dimensions'.\nIn the vulnerable implementation, the calculation for the allocation size utilizes the size_t type initially, but during the assignment or preparation for the memory allocation call, this value is truncated to a signed 32-bit integer (int). If the product of the entries and dimensions is sufficiently large, the high-order bits are discarded due to this truncation. Consequently, a significantly smaller memory buffer is allocated on the heap than is actually required to store the subsequent decoding data.\nThe exploitation flow begins when an attacker distributes a maliciously crafted Ogg Vorbis file. Upon invocation of the decoder, the library reads the attacker-supplied entries and dimensions. The internal logic triggers the truncated allocation, resulting in a heap buffer that is undersized for the subsequent write operations.\nAs the decoder proceeds to populate the codebook multiplicands, the code performs out-of-bounds writes into the heap memory immediately adjacent to the undersized buffer. Because the application logic trusts the intended size rather than the actual allocated size, it continues to write data beyond the bounds of the heap chunk.\nThis out-of-bounds access allows an attacker to overwrite sensitive metadata or adjacent heap objects. Depending on the memory layout of the host application, this corruption can be leveraged to divert program control flow or overwrite function pointers, potentially leading to arbitrary code execution within the security context of the process. In less complex scenarios, the corruption of heap metadata leads to an immediate crash or undefined behavior, causing a denial of service.\nThe flaw affects all stb_vorbis versions through 1.22. It does not require authentication or specific privileges beyond the user-level permissions to trigger the file decoding process, making it accessible via various network or local vectors where Ogg Vorbis content is parsed."
}