Heap buffer out of bounds write in start_decoder in stb_vorbis
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.
Summary
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[len] = (char)'\0';`. The root cause is that if `len` read in `start_decoder` is a negative number and `setup_malloc` successfully allocates memory in that case, but memory write is done with a negative index `len`. Similarly if len is INT_MAX the integer overflow len+1 happens in `f->vendor = (char*)setup_malloc(f, sizeof(char) * (len+1));` and `f->comment_list[i] = (char*)setup_malloc(f, sizeof(char) * (len+1));`. This issue may lead to code execution.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-45677
References
Advisory 6
- https://securitylab.github.com/advisories/GHSL-2023-145_GHSL-2023-151_stb_image_h/
- https://github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_vorbis.c#L3652-L3658
- https://github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_vorbis.c#L3653
- https://github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_vorbis.c#L3658
- https://github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_vorbis.c#L3670C7-L3670C75
- https://github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_vorbis.c#L950-L961
More nothings Stb Vorbis.c vulnerabilities
- TI-2023-25531 Integer overflow in stb_vorbis.c CVSS 3.1CRITICAL 9.8
- TI-2023-24478 Attempt to free an uninitialized memory pointer in vorbis_deinit in stb_vorbis CVSS 3.1HIGH 7.8
- TI-2023-24477 Off-by-one heap buffer write in start_decoder in stb_vorbis CVSS 3.1HIGH 7.8
- TI-2023-24475 Multi-byte write heap buffer overflow in start_decoder in stb_vorbis CVSS 3.1HIGH 7.8
- TI-2023-24474 0 byte write heap buffer overflow in start_decoder in stb_vorbis CVSS 3.1HIGH 7.8
- TI-2023-24481 Wild address read in vorbis_decode_packet_rest in stb_vorbis CVSS 3.1HIGH 7.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences