CVE-2026-89266

stb_vorbis, a widely embedded open-source Ogg Vorbis audio decoder, contains a heap buffer overflow in its start_decoder() function where the codebook multiplicands allocation size is truncated from size_t to int. An attacker can craft a malicious Ogg Vorbis file with large entries and dimensions values, and the truncation causes an undersized allocation and out-of-bounds writes when the file is decoded. Successful exploitation can crash the process or corrupt heap memory, with the CVSS 4.0 score reflecting high availability impact and low integrity impact and no confidentiality impact. Any application, game, or tool that embeds stb_vorbis version 1.22 or earlier and decodes untrusted Ogg Vorbis files is affected, which spans a very large downstream ecosystem of bundled software. No public proof-of-concept is known, the flaw is not in CISA's KEV catalog, and exploitation has not been reported in the wild.

What to do: Inventory builds for vendored copies of stb_vorbis.c/stb_vorbis.h and upgrade to a release newer than 1.22 as soon as an upstream fix is published, then rebuild and redeploy. Until patched, restrict decoding of untrusted Ogg Vorbis files, and consider sandboxing or fuzz-hardening audio decoding paths in media- and game-facing applications. Monitor for a vendor advisory and proof-of-concept code given the library's broad embed base.