CVE-2023-45676 Multi-byte write heap buffer overflow in start_decoder in stb_vorbis

2023-10-2023:26:47

CWE-787

GitHub_M

github.com

cve-2023-45676

heap buffer overflow

stb_vorbis

integer overflow

code execution

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

partial

JSON

stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in f->vendor[i] = get8_packet(f);. The root cause is an integer overflow in setup_malloc. A sufficiently large value in the variable sz overflows with sz+7 in and the negative value passes the maximum available memory buffer check. This issue may lead to code execution.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:nothings:stb:*:*:*:*:*:*:*:*"
    ],
    "vendor": "nothings",
    "product": "stb",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "1.22"
      }
    ],
    "defaultStatus": "unknown"
  }
]