Nothings Stb Vorbis vulnerabilities

1 vulnerability

Known vulnerabilities in Nothings Stb Vorbis, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

8.8CVE-2026-89266debianlibstb+2
EPSS score
0.64%
stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook multiplicands allocation size is truncated from size_t to int. Attackers can craft a malicious Ogg Vorbis file with large entries and dimensions values to trigger out-of-bounds writes, causing process crashes or heap corruption.