Multi-byte write heap buffer overflow in start_decoder in stb_vorbis

CVE-2023-45676

What is CVE-2023-45676?

The stb_vorbis library, utilized for processing Ogg Vorbis files, contains a vulnerability that can lead to out of bounds writes. This issue arises from an integer overflow in the setup_malloc function. When a crafted file is processed, a specific condition allows for an overflow of the size variable (sz), permitting the negative result to bypass memory buffer checks. As a consequence, this can result in unauthorized code execution, posing a significant risk to applications utilizing the library.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References