Every CVE Search/ Get API key

CVE-2026-89266

stb_vorbis through 1.22 heap buffer overflow via codebook multiplicands

8.8 High

CVE-2026-89266 is a high vulnerability (CVSS 8.8) in Nothings Stb Vorbis, published September 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.64%, the 50th percentile. No source names a fixed version.

stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook multiplicands allocation size is truncated from size_t to int. Attackers can craft a malicious Ogg Vorbis file with large entries and dimensions values to trigger out-of-bounds writes, causing process crashes or heap corruption.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
High

Exploit likelihood

0.64%Up 0.2 points since Sep 12, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.8

stb_vorbis through 1.22 heap buffer overflow via codebook multiplicands

stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook multiplicands allocation size is truncated from size_t to int. Attackers can craft a malicious Ogg Vorbis file with large entries and dimensions values to trigger out-of-bounds writes, causing process crashes or heap corruption.

Record
CVE-2026-89266
CVSS 4.0
8.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Weakness
CWE-787
Updated
2026-11-02
EUVDEUVD-2026-76770 8.8

stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook multiplicands allocation size is truncated from size_t to int. Attackers can craft a malicious Ogg Vorbis file with large entries and dimensions values to trigger out-of-bounds writes, causing process crashes or heap corruption.

Record
EUVD-2026-76770
CVSS 4.0
8.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-4hj2-h365-qx39 8.8

stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook...

stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook multiplicands allocation size is truncated from size_t to int. Attackers can craft a malicious Ogg Vorbis file with large entries and dimensions values to trigger out-of-bounds writes, causing process crashes or heap corruption.

Record
GHSA-4hj2-h365-qx39
CVSS 4.0
8.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Weakness
CWE-787
Updated
2026-11-02
NVD 8.8

stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook multiplicands allocation size is truncated from size_t to int. Attackers can craft a malicious Ogg Vorbis file with large entries and dimensions values to trigger out-of-bounds writes, causing process crashes or heap corruption.

Record
CVE-2026-89266
CVSS 4.0
8.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Weakness
CWE-787
Updated
2026-11-02
OSVDEBIAN-CVE-2026-89266 8.8

stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook multiplicands allocation size is truncated from size_t to int. Attackers can craft a malicious Ogg Vorbis file with large entries and dimensions values to trigger out-of-bounds writes, causing process crashes or heap corruption.

Record
DEBIAN-CVE-2026-89266
CVSS 4.0
8.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVUBUNTU-CVE-2026-89266 8.8

stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook multiplicands allocation size is truncated from size_t to int. Attackers can craft a malicious Ogg Vorbis file with large entries and dimensions values to trigger out-of-bounds writes, causing process crashes or heap corruption.

Record
UBUNTU-CVE-2026-89266
CVSS 4.0
8.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libstb
Debian:12
 All versions, plus listed versions
0.0~git20220908.8b5f1f3+ds-10.0~git20230129.5736b15+ds-10.0~git20230129.5736b15+ds-1.10.0~git20230129.5736b15+ds-1.1~exp10.0~git20230129.5736b15+ds-1.20.0~git20240715.f7f20f39fe4f+ds-10.0~git20241109.5c20573+ds-10.0~git20250907.fede005+ds-1
 None known
libstb
Debian:13
 All versions, plus listed versions
0.0~git20241109.5c20573+ds-10.0~git20250907.fede005+ds-1
 None known
libstb
Debian:14
 All versions, plus listed versions
0.0~git20241109.5c20573+ds-10.0~git20250907.fede005+ds-1
 None known
libstb
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.0~git20190817.1.052dce1-1
 None known
libstb
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.0~git20200713.b42009b+ds-10.0~git20210910.af1a5bc+ds-1
 None known
libstb
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.0~git20230129.5736b15+ds-10.0~git20230129.5736b15+ds-1.10.0~git20230129.5736b15+ds-1.2
 None known
libstb
Ubuntu:26.10
 All versions, plus listed versions
0.0~git20250907.fede005+ds-1
 None known
libstb
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.0~git20241109.5c20573+ds-10.0~git20250907.fede005+ds-1
 None known

History

History
WhenChangedSources
2026-11-02createdCVE List, EUVD, GitHub Advisories, NVD, OSV

References

Show 5 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open