Heap Buffer Overflow in stb_vorbis Affected by Malicious Ogg Vorbis Files

CVE-2026-89266

What is CVE-2026-89266?

The stb_vorbis library, specifically versions up to 1.22, is affected by a heap buffer overflow vulnerability in the start_decoder() function. This issue arises due to the improper handling of codebook multiplicands allocation size, which is truncated from size_t to int. Attackers can exploit this flaw by crafting malicious Ogg Vorbis files with excessively large entries and dimension values, leading to out-of-bounds writes. This can result in process crashes or undermine the integrity of the heap, presenting significant risks to applications utilizing the library.

References