VULNERABILITY INTELLIGENCE

CVE-2023-45678

CVSS score6.5 MEDIUM
EPSS probability0.74%
CISA KEVNot currently listed
Published2023-10-21
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Description

stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of buffer write in `start_decoder` because at maximum `m->submaps` can be 16 but `submap_floor` and `submap_residue` are declared as arrays of 15 elements. This issue may lead to code execution.

Weakness classification

  • CWE-787: Out-of-bounds Write

Primary references