EUVD-2026-18114Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A security flaw has been discovered in Nothings stb up to 1.22. This affects the function start_decoder of the file stb_vorbis.c. The manipulation results in out-of-bounds write. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Out-of-bounds write in Nothings stb library up to version 1.22 allows remote attackers to corrupt memory and potentially execute code by crafting malicious Vorbis audio files that trigger improper bounds checking in the start_decoder function. Publicly available exploit code exists for this vulnerability, which affects all applications statically linking vulnerable stb_vorbis.c code. The vendor has not responded to disclosure attempts, leaving deployed instances without an official patch.
Technical ContextAI
The stb_vorbis.c library is a single-file Vorbis audio decoder commonly embedded in game engines, multimedia applications, and other software that require lightweight audio decoding. The vulnerability exists in the start_decoder function, which processes Vorbis packet headers. The root cause is a classic out-of-bounds write (CWE-787), where insufficient validation of input parameters or array bounds during packet parsing allows an attacker to write data beyond allocated buffer boundaries. Since stb is typically statically linked as a header-only library, every application incorporating the vulnerable code becomes a potential attack surface. The remote attack vector means exploitation requires only transmitting a crafted Vorbis bitstream-no local access is necessary.
RemediationAI
Users must update to stb library version 1.23 or later if such a release addressing this flaw is available; however, the vendor's non-responsiveness to disclosure suggests checking the official Nothings stb GitHub repository (https://github.com/nothings/stb) for the latest version and any security advisories. For applications that cannot immediately upgrade, implement strict input validation and sandboxing of audio decoding operations-parse Vorbis files only from trusted sources, disable automatic audio playback from untrusted media, and consider isolating audio decoding to a separate process with restricted memory access. Developers should audit their dependency on stb versions and either update their embedded copy or switch to a maintained, actively-patched audio decoding library if stb updates remain unavailable. Provide security advisories to end users of affected applications recommending they avoid opening untrusted audio files until patched.
stb_image.h (aka the stb image loader) 2.23 has a heap-based buffer over-read in stbi__tga_load, leading to Information
STB v2.27 was discovered to contain an integer shift of invalid size in the component stbi__jpeg_decode_block_prog_ac. R
Buffer overflow vulnerability in function stbi__extend_receive in stb_image.h in stb 2.26 via a crafted JPEG file. Rated
Resource exhaustion in Nothings stb library versions up to 1.22 allows unauthenticated remote attackers to cause denial
Out-of-bounds read in Nothings stb library up to version 1.26 allows remote attackers to trigger information disclosure
Denial of service vulnerability in Nothings stb image library (stb_image.h) affecting GIF decoder function stbi__gif_loa
Double free vulnerability in Nothings stb library (up to version 2.30) in the multi-frame GIF file handler function stbi
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allVendor StatusVendor
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 0.0~git20200713.b42009b+ds-1 | - |
| bullseye (security) | vulnerable | 0.0~git20200713.b42009b+ds-1+deb11u1 | - |
| bookworm | vulnerable | 0.0~git20220908.8b5f1f3+ds-1 | - |
| trixie | vulnerable | 0.0~git20241109.5c20573+ds-1 | - |
| forky, sid | vulnerable | 0.0~git20250907.fede005+ds-1 | - |
| (unstable) | fixed | (unfixed) | - |
Share
External POC / Exploit Code
Leaving vuln.today