Heap buffer out of bounds write in start_decoder in stb_vorbis

CVE-2023-45677

What is CVE-2023-45677?

The stb_vorbis library, a single-file MIT licensed library for processing Ogg Vorbis files, is susceptible to an out of bounds write vulnerability. This arises when negative values are read for length within the decoder setup. In scenarios where memory is allocated correctly but an invalid length is used in subsequent operations, it can result in writing outside the allocated memory area. This flaw can lead to potential code execution vulnerabilities when handling crafted Ogg Vorbis files.

References