CVE-2023-45675

What it actually does

Out-of-bounds write in stb_vorbis start_decoder when len read as -1 causes len+1 to become 0, and setup_malloc on a pre-allocated buffer returns a non-NULL pointer allowing write of a null byte beyond intended bounds, enabling arbitrary code execution.

Why it matters to the business

Attackers can execute code on systems that process untrusted Ogg Vorbis files, leading to compromise of media playback or processing applications and potential full system takeover.

How an attack unfolds

An attacker crafts a malicious Ogg Vorbis file that triggers the integer condition in start_decoder, causing the library to perform an out-of-bounds write when the file is opened by any application using the vulnerable stb_vorbis code.

How to fix it

Upgrade stb_vorbis to a version containing the fix; on Debian 13 this is available in package version 6.6.15-1. Rebuild and redeploy any applications statically linking the library. Disable processing of untrusted Vorbis files until patched.

How to confirm the fix worked

Verify that the installed stb_vorbis source or binary no longer contains the vulnerable start_decoder path and that package version reports 6.6.15-1 or later on Debian 13 systems. Re-run any unit tests that exercise decoder initialization with edge-case lengths.

Typical attack path

1. Attacker creates a specially crafted Ogg Vorbis audio file.
2. Victim application opens or processes the malicious file using stb_vorbis.
3. start_decoder reads len as -1 and calls setup_malloc with size 0 on a pre-allocated buffer.
4. Library writes null byte outside allocated region.
5. Memory corruption leads to control-flow hijacking and code execution.

How to detect it

Search application and system logs for crashes or unexpected terminations when processing Ogg Vorbis files; inspect core dumps or memory dumps around decoder initialization routines for signs of out-of-bounds writes.

What your security team should do

• Immediately update affected packages to version 6.6.15-1 on Debian 13.
• Inventory all applications that statically or dynamically link stb_vorbis.
• Apply compensating controls such as file-type sandboxing for media processing until patches are deployed.
• Monitor upstream stb_vorbis repository for any additional related fixes.