Attempt to free an uninitialized memory pointer in vorbis_deinit in stb_vorbis

CVE-2023-45679

What is CVE-2023-45679?

The stb_vorbis library, utilized for managing ogg vorbis files, exhibits a vulnerability where a crafted file can trigger a memory allocation failure in the start_decoder function. When this happens, the function prematurely exits, leaving some pointers in f->comment_list uninitialized. Consequently, when the setup_free function is invoked in vorbis_deinit, it operates on these uninitialized pointers, presenting a serious risk of arbitrary code execution.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References