CVE-2026-89266 — stb_vorbis through 1.22 heap buffer overflow via codebook multiplicands
stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook multiplicands allocation size is truncated from size_t to int. Attackers can craft …
Published: 2026-09-11 · CVSS: 8.8 · CVSS 4.0
stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook multiplicands allocation size is truncated from size_t to int. Attackers can craft a malicious Ogg Vorbis file with large entries and dimensions values to trigger out-of-bounds writes, causing process crashes or heap corruption.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7