CVE-2023-45678 Off-by-one heap buffer write in start_decoder in stb_vorbis

2023-10-2023:26:51

CWE-787

GitHub_M

github.com

cve-2023-45678

off-by-one

heap buffer

start_decoder

stb_vorbis

library

ogg vorbis

crafted file

buffer write

code execution

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

partial

JSON

stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of buffer write in start_decoder because at maximum m->submaps can be 16 but submap_floor and submap_residue are declared as arrays of 15 elements. This issue may lead to code execution.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:nothings:stb:*:*:*:*:*:*:*:*"
    ],
    "vendor": "nothings",
    "product": "stb",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "1.22"
      }
    ],
    "defaultStatus": "unknown"
  }
]