CVE-2026-5317 Nothings stb stb_vorbis.c start_decoder out-of-bounds write
Remote attackers can trigger an out-of-bounds write in the stb_vorbis decoder, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-5317?
CVE-2026-5317 is a medium-severity memory corruption vulnerability in Nothings stb, published on 2 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A security flaw has been discovered in Nothings stb up to 1.22. This affects the function start_decoder of the file stb_vorbis.c. The manipulation results in out-of-bounds write. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Which versions are affected by CVE-2026-5317?
It affects 1 product.
Products include Nothings Stb Vorbis.c.
How do I fix CVE-2026-5317?
No fix has been published for CVE-2026-5317 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-5317 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-5317 exists.
Other vulnerabilities in Nothings stb
- CVE-2023-45676 Multi-byte write heap buffer overflow in start_decoder in stb_vorbis
- CVE-2023-45677 Heap buffer out of bounds write in start_decoder in stb_vorbis
- CVE-2023-45679 Attempt to free an uninitialized memory pointer in vorbis_deinit in stb_vorbis
- CVE-2023-45681 Out of bounds heap buffer write in stb_vorbis
- CVE-2023-45675 0 byte write heap buffer overflow in start_decoder in stb_vorbis
Sources
Also known as DEBIAN-CVE-2026-5317, GHSA-8mhm-8wmq-8793, UBUNTU-CVE-2026-5317.