stb_vorbis vulnerabilities

1 known vulnerability in stb_vorbis from Nothings. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.2 High severity

  stb_vorbis: Out-of-bounds Write

  CVE-2026-89266Sep 12, 2026Nothings

  stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook multiplicands allocation size is truncated from size_t to int. Attackers can craft a malicious Ogg Vorbis file with large entries and dimensions values to trigger out