An out-of-bounds write occurs in the start_decoder function of stb_vorbis.c when decoding Vorbis audio data. The flaw can corrupt memory registers and, if triggered by crafted Vorbis streams, potentially allow arbitrary code execution or crash the application. The vulnerability has an attacker able to target a system remotely by providing malicious audio input.

The vulnerability affects the Nothings stb library in versions up to 1.22, which is used by many open-source applications that embed stb_vorbis for audio decoding. Any product shipping with these or earlier versions is potentially exposed.

The CVSS score of 5.3 denotes a Medium severity. EPSS data is unavailable, so the precise probability of exploitation is unclear, but the public availability of an exploit and the remote attack surface raise the risk. The issue is not in the CISA KEV catalog; however, without an official patch, the risk remains moderate, with the possibility of denial of service or code execution if memory corruption is leveraged.