CVE-2023-45678 Off-by-one heap buffer write in start_decoder in stb_vorbis

2023-10-2023:26:51

CWE-787

GitHub_M

www.cve.org

cve-2023-45678

heap buffer

start_decoder

stb_vorbis

ogg vorbis

array

code execution

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

0.001 Low

EPSS

Percentile

28.7%

JSON

stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of buffer write in start_decoder because at maximum m->submaps can be 16 but submap_floor and submap_residue are declared as arrays of 15 elements. This issue may lead to code execution.

CNA Affected

[
  {
    "vendor": "nothings",
    "product": "stb",
    "versions": [
      {
        "version": "<= 1.22",
        "status": "affected"
      }
    ]
  }
]