CVE-2026-89266: stb_vorbis Buffer Overflow Vulnerability

CVE-2026-89266 Overview

CVE-2026-89266 is a heap buffer overflow in the stb_vorbis single-file Ogg Vorbis decoder library through version 1.22. The flaw resides in the start_decoder() function, where the allocation size for codebook multiplicands is truncated from size_t to int. An attacker who supplies a crafted Ogg Vorbis file with large entries and dimensions values can trigger out-of-bounds writes on the heap. Successful exploitation causes process crashes or heap corruption in any application that decodes untrusted audio using stb_vorbis. The library is widely embedded in games, media tools, and multimedia frameworks, expanding the potential attack surface.

Critical Impact
A single malicious .ogg file processed by an application linking stb_vorbis can corrupt heap memory and crash the host process, with potential for further exploitation.

Affected Products

stb_vorbis through version 1.22
Applications and libraries statically embedding stb_vorbis.c from the nothings/stb repository
Downstream projects that vendored stb_vorbis prior to a fixed commit

Discovery Timeline

2026-09-12 - CVE-2026-89266 published to NVD
2026-09-20 - Last updated in NVD database

Technical Details for CVE-2026-89266

Vulnerability Analysis

The vulnerability is an out-of-bounds write classified as [CWE-787]. Inside start_decoder(), stb_vorbis parses Vorbis codebook headers and allocates a buffer sized by the product of entries and dimensions fields read directly from the file. The multiplication is performed using narrower integer arithmetic and the result is stored in an int before being passed to the allocator. When the true byte count exceeds INT_MAX, the value wraps or truncates, yielding an undersized allocation.

Subsequent parsing then writes the full number of multiplicand entries into that undersized buffer, overflowing adjacent heap memory. Because the decoder runs early in the file-parsing path, exploitation requires no authentication and no user interaction beyond opening or streaming the audio file. Refer to the VulnCheck STB Vorbis Advisory for additional analysis.

Root Cause

The root cause is a numeric truncation error. The allocation size calculation for codebook multiplicands narrows a size_t product to a signed int, discarding high-order bits. Attacker-controlled entries and dimensions values from the Ogg Vorbis header drive the truncated computation, so the allocator returns a buffer smaller than the number of elements the decoder later writes. See the referenced code locations in stb_vorbis.c line 950 and lines 3878-3880.

Attack Vector

An attacker crafts an Ogg Vorbis file with abnormally large entries and dimensions fields in a codebook header. Delivery vectors include email attachments, web downloads, game asset packs, embedded audio in documents, and streaming endpoints. When a vulnerable application invokes stb_vorbis to decode the file, the truncated allocation triggers a heap out-of-bounds write. The immediate outcome is process crash or heap corruption; depending on allocator behavior and the surrounding application, the write may be leveraged for further exploitation.

No public proof-of-concept exploit is listed for this CVE at the time of publication. Additional discussion is available in GitHub STB Issue #1928, Issue #1933, and Issue #1947.

Detection Methods for CVE-2026-89266

Indicators of Compromise

Unexpected crashes, segmentation faults, or heap corruption reports in processes that decode Ogg Vorbis audio.
Ogg Vorbis files with codebook headers containing implausibly large entries or dimensions values.
Application error telemetry referencing start_decoder, setup_malloc, or nearby stb_vorbis symbols.

Detection Strategies

Inventory software that vendors stb_vorbis.c by scanning source trees, container images, and static binaries for the file and version markers.
Enable AddressSanitizer or heap hardening (for example, MALLOC_CHECK_, guard pages) in test builds to surface out-of-bounds writes during fuzzing of Ogg inputs.
Fuzz stb_vorbis integrations with malformed Ogg Vorbis samples focused on codebook header fields.

Monitoring Recommendations

Alert on repeated crashes of media-handling processes correlated with recently downloaded or received .ogg files.
Monitor endpoint telemetry for abnormal child process behavior or memory corruption events in applications that ingest user-supplied audio.
Track file provenance for Ogg Vorbis assets entering asset pipelines, chat platforms, and content management systems.

How to Mitigate CVE-2026-89266

Immediate Actions Required

Identify all applications and libraries that embed stb_vorbis and record the vendored version or commit hash.
Update to a patched revision of stb_vorbis from the upstream nothings/stb repository once a fix is merged, and rebuild dependent binaries.
Restrict processing of Ogg Vorbis files from untrusted sources until fixed builds are deployed.

Patch Information

Monitor the upstream nothings/stb repository and the tracking issues (#1928, #1933, #1947) for the corrective commit that validates entries and dimensions and performs the multiplicand allocation using size_t arithmetic with overflow checks. Because stb_vorbis is a single-file library, downstream projects must re-vendor the fixed source and rebuild rather than rely on a package manager update.

Workarounds

Reject or pre-validate Ogg Vorbis files at the application boundary, capping acceptable entries and dimensions header values before invoking the decoder.
Isolate audio decoding in a sandboxed or low-privilege process so that heap corruption cannot compromise the parent application.
Replace stb_vorbis with an alternative Vorbis decoder such as libvorbis where feasible for high-risk ingestion paths.

bash

# Locate vendored stb_vorbis copies across a codebase
grep -rIn --include='*.c' --include='*.h' \
    -e 'stb_vorbis' -e 'STB_VORBIS_INCLUDE_STB_VORBIS_H' .

# Example allocation guard to enforce before decoding untrusted input
# (pseudo-configuration for an application wrapper)
MAX_VORBIS_ENTRIES=65536
MAX_VORBIS_DIMENSIONS=256