CVE-2026-89266: stb_vorbis through 1.22 heap buffer overflow via codebook multiplicands
stbvorbis through 1.22 contains a heap buffer overflow in startdecoder() where the codebook multiplicands allocation size is truncated from sizet to int. Attackers can craft a malicious Ogg Vorbis file with large entries and dimensions values to trigger out-of-bounds writes, causing process crashes or heap corruption.
Affected Software
Event History
Frequently Asked Questions
What must an attacker provide to trigger the flaw?
An attacker must get the vulnerable application to process a malicious Ogg Vorbis file whose codebook contains large entries and dimensions values. No privileges or user interaction are required according to the supplied vector.
What is the likely impact to an affected application?
Processing the crafted file can cause out-of-bounds heap writes due to truncation of the codebook multiplicands allocation size. This can crash the process or result in heap corruption.
Which versions should be considered affected?
The issue is reported in stb_vorbis through version 1.22. The provided information does not identify a fixed version.