Wild address read in vorbis_decode_packet_rest in stb_vorbis
CVE-2023-45682

5.3MEDIUM

Key Information:

Vendor: Nothings
Status: Stb
Vendor: CVE Published:; 21 October 2023

What is CVE-2023-45682?

stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds read in DECODE macro when var is negative. As it can be seen in the definition of DECODE_RAW a negative var is a valid value. This issue may be used to leak internal memory allocation information.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch