CVE-2023-45676

Multi-byte write heap buffer overflow in start_decoder in stb_vorbis

7.3 HighFix available

stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in f->vendor[i] = get8_packet(f);. The root cause is an integer overflow in setup_malloc. A sufficiently large value in the variable sz overflows with sz+7 in and the negative value passes the maximum available memory buffer check. This issue may lead to code execution.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: Low

Exploit likelihood

0.51%Up 0.5 points since Oct 21, 2023

What each source reports

CVE List Score used 7.3

Multi-byte write heap buffer overflow in start_decoder in stb_vorbis

Record: CVE-2023-45676
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-787
Updated: 2026-11-02

EUVDEUVD-2023-49966 7.3

Record: EUVD-2023-49966
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated: 2026-11-03

NVD 7.3

Record: CVE-2023-45676
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

OSV 7.3

Multi-byte write heap buffer overflow in start_decoder in stb_vorbis

Record: CVE-2023-45676
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-787
Updated: 2026-11-02

OSVDEBIAN-CVE-2023-45676 7.8

Record: DEBIAN-CVE-2023-45676
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-45676 7.3

Record: UBUNTU-CVE-2023-45676
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 4 moreShow less

OSVMGASA-2026-0191 No score

Updated libxmp packages fix security vulnerabilities

CVE-2023-45679: Attempt to free an uninitialized memory pointer in vorbis_deinit() CVE-2023-45680: Null pointer dereference in vorbis_deinit() CVE-2023-45681: Out of bounds heap buffer write CVE-2023-45676: Multi-byte write heap buffer overflow in start_decoder() CVE-2023-45677: Heap buffer out of bounds write in start_decoder() CVE-2023-45682: Wild address read in vorbis_decode_packet_rest() CVE-2025-47256 stack-based buffer overflow in depack_pha in loaders/prowizard/pha.c via a malformed Pha format tracker module in a .mod file.

Record: MGASA-2026-0191
Updated: 2026-11-02

OSVopenSUSE-SU-2025:0037-1 No score

Security update for SDL2_sound

This update for SDL2_sound fixes the following issues:

Update to release 2.0.4:
- Update bundled stb_vorbis to address CVE-2023-45676, CVE-2023-45677, CVE-2023-45679, CVE-2023-45680, CVE-2023-45681, CVE-2023-45682.
Update to release 2.0.2
- No further changes from the last snapshot 2.0.1+g60

Record: openSUSE-SU-2025:0037-1
Updated: 2026-11-02

OSVopenSUSE-SU-2025:14642-1 No score

SDL2_sound-devel-2.0.4-1.1 on GA media

These are all security issues fixed in the SDL2_sound-devel-2.0.4-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2025:14642-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:10978-1 No score

SDL3_sound-devel-3.2.0-1.1 on GA media

These are all security issues fixed in the SDL3_sound-devel-3.2.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:10978-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`libstb` Debian:12	All versions, plus listed versions 0.0~git20220908.8b5f1f3+ds-10.0~git20230129.5736b15+ds-10.0~git20230129.5736b15+ds-1.10.0~git20230129.5736b15+ds-1.1~exp10.0~git20230129.5736b15+ds-1.20.0~git20240715.f7f20f39fe4f+ds-10.0~git20241109.5c20573+ds-10.0~git20250907.fede005+ds-1	None known
`libstb` Debian:13	All versions, plus listed versions 0.0~git20241109.5c20573+ds-10.0~git20250907.fede005+ds-1	None known
`libstb` Debian:14	All versions, plus listed versions 0.0~git20241109.5c20573+ds-10.0~git20250907.fede005+ds-1	None known
`libxmp` Mageia:9	before 4.5.0-2.1.mga9	4.5.0-2.1.mga9
`libstb` Ubuntu:20.04:LTS	All versions, plus listed versions 0.0~git20190817.1.052dce1-1	None known
`libstb` Ubuntu:22.04:LTS	All versions, plus listed versions 0.0~git20200713.b42009b+ds-10.0~git20210910.af1a5bc+ds-1	None known
`libstb` Ubuntu:24.04:LTS	All versions, plus listed versions 0.0~git20230129.5736b15+ds-10.0~git20230129.5736b15+ds-1.10.0~git20230129.5736b15+ds-1.2	None known
`libstb` Ubuntu:25.10	All versions, plus listed versions 0.0~git20240715.f7f20f39fe4f+ds-10.0~git20241109.5c20573+ds-1	None known
`libstb` Ubuntu:26.10	All versions, plus listed versions 0.0~git20250907.fede005+ds-1	None known
`libstb` Ubuntu:26.04:LTS	All versions, plus listed versions 0.0~git20241109.5c20573+ds-10.0~git20250907.fede005+ds-1	None known

Show 4 moreShow less

Affected packages
Package	Affected	Fixed
`SDL2_sound` SUSE:Package Hub 15 SP6	before 2.0.4-bp156.2.3.1	2.0.4-bp156.2.3.1
`SDL2_sound` openSUSE:Leap 15.6	before 2.0.4-bp156.2.3.1	2.0.4-bp156.2.3.1
`SDL2_sound` openSUSE:Tumbleweed	before 2.0.4-1.1	2.0.4-1.1
`SDL3_sound` openSUSE:Tumbleweed	before 3.2.0-1.1	3.2.0-1.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-45676 is a high vulnerability (CVSS 7.3) in Nothings Stb, published October 20, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.51%, the 43rd percentile. Fixed in libxmp 4.5.0-2.1.mga9.

References

Show 15 moreShow less