CVE-2026-5317: Nothings stb stb_vorbis.c start_decoder out-of-bounds write
A security flaw has been discovered in Nothings stb up to 1.22. This affects the function startdecoder of the file stbvorbis.c. The manipulation results in out-of-bounds write. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5317?
The severity of CVE-2026-5317 is currently rated as high due to the potential for remote exploitation and out-of-bounds write vulnerability.
How do I fix CVE-2026-5317?
To fix CVE-2026-5317, you should upgrade Nothings stb to version 1.23 or later, which resolves this out-of-bounds write issue.
What software is affected by CVE-2026-5317?
CVE-2026-5317 affects Nothings stb versions up to and including 1.22, specifically the stb_vorbis.c file.
Can CVE-2026-5317 be exploited remotely?
Yes, CVE-2026-5317 can be exploited remotely, allowing an attacker to manipulate the vulnerable function to achieve an out-of-bounds write.
What type of vulnerability is CVE-2026-5317?
CVE-2026-5317 is categorized as an out-of-bounds write vulnerability, which may lead to arbitrary code execution or crashes.