CVE-2023-45676 Multi-byte write heap buffer overflow in start_decoder in stb_vorbis
A crafted Ogg Vorbis file triggers a heap buffer overflow in the stb_vorbis library, potentially allowing remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-45676?
CVE-2023-45676 is a high-severity memory corruption vulnerability in nothings stb, published on 20 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[i] = get8_packet(f);`. The root cause is an integer overflow in `setup_malloc`. A sufficiently large value in the variable `sz` overflows with `sz+7` in and the negative value passes the maximum available memory buffer check. This issue may lead to code execution.
Weakness: CWE-787
Which versions are affected by CVE-2023-45676?
It affects 1 product.
Products include Nothings Stb Vorbis.c.
How do I fix CVE-2023-45676?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-45676 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-45676 exists.
Other vulnerabilities in nothings stb
- CVE-2023-45677 Heap buffer out of bounds write in start_decoder in stb_vorbis
- CVE-2023-45679 Attempt to free an uninitialized memory pointer in vorbis_deinit in stb_vorbis
- CVE-2023-45681 Out of bounds heap buffer write in stb_vorbis
- CVE-2023-45675 0 byte write heap buffer overflow in start_decoder in stb_vorbis
- CVE-2023-45678 Off-by-one heap buffer write in start_decoder in stb_vorbis
Sources
Also known as DEBIAN-CVE-2023-45676, UBUNTU-CVE-2023-45676.