CVE-2023-45678

Off-by-one heap buffer write in start_decoder in stb_vorbis

6.5 Medium

CVE-2023-45678 is a medium vulnerability (CVSS 6.5) in Nothings Stb, published October 20, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.74%, the 54th percentile. No source names a fixed version.

stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of buffer write in start_decoder because at maximum m->submaps can be 16 but submap_floor and submap_residue are declared as arrays of 15 elements. This issue may lead to code execution.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: Low

Exploit likelihood

0.74%Up 0.7 points since Oct 21, 2023

What each source reports

CVE List Score used 6.5

Off-by-one heap buffer write in start_decoder in stb_vorbis

Record: CVE-2023-45678
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness: CWE-787
Updated: 2026-11-02

EUVDEUVD-2023-49968 6.5

Record: EUVD-2023-49968
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated: 2026-11-03

NVD 6.5

Record: CVE-2023-45678
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

OSV 6.5

Off-by-one heap buffer write in start_decoder in stb_vorbis

Record: CVE-2023-45678
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness: CWE-787
Updated: 2026-11-02

OSVDEBIAN-CVE-2023-45678 7.8

Record: DEBIAN-CVE-2023-45678
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-45678 6.5

Record: UBUNTU-CVE-2023-45678
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`libstb` Debian:12	All versions, plus listed versions 0.0~git20220908.8b5f1f3+ds-10.0~git20230129.5736b15+ds-10.0~git20230129.5736b15+ds-1.10.0~git20230129.5736b15+ds-1.1~exp10.0~git20230129.5736b15+ds-1.20.0~git20240715.f7f20f39fe4f+ds-10.0~git20241109.5c20573+ds-10.0~git20250907.fede005+ds-1	None known
`libstb` Debian:13	All versions, plus listed versions 0.0~git20241109.5c20573+ds-10.0~git20250907.fede005+ds-1	None known
`libstb` Debian:14	All versions, plus listed versions 0.0~git20241109.5c20573+ds-10.0~git20250907.fede005+ds-1	None known
`libstb` Ubuntu:20.04:LTS	All versions, plus listed versions 0.0~git20190817.1.052dce1-1	None known
`libstb` Ubuntu:22.04:LTS	All versions, plus listed versions 0.0~git20200713.b42009b+ds-10.0~git20210910.af1a5bc+ds-1	None known
`libstb` Ubuntu:24.04:LTS	All versions, plus listed versions 0.0~git20230129.5736b15+ds-10.0~git20230129.5736b15+ds-1.10.0~git20230129.5736b15+ds-1.2	None known
`libstb` Ubuntu:25.10	All versions, plus listed versions 0.0~git20240715.f7f20f39fe4f+ds-10.0~git20241109.5c20573+ds-1	None known
`libstb` Ubuntu:26.10	All versions, plus listed versions 0.0~git20250907.fede005+ds-1	None known
`libstb` Ubuntu:26.04:LTS	All versions, plus listed versions 0.0~git20241109.5c20573+ds-10.0~git20250907.fede005+ds-1	None known

History

History
When	Changed	Sources
2026-11-03	aliases, published	EUVD
2026-11-02	created	CVE List, NVD, OSV