The vulnerability causes stb_vorbis to allocate memory for codebook multiplicands using an int instead of a size_t, which truncates values from the Vorbis header. This leads to out‑of‑bounds writes on the heap, resulting in memory corruption that can crash the decoder or, in some contexts, allow an attacker to hijack control flow, potentially enabling arbitrary code execution or denial of service.

All published releases of the stb_vorbis audio decoding library up to and including version 1.22 are affected. The library is provided by the nothings project and is used in media players, streaming applications, and embedded devices that decode Vorbis audio streams.

The CVSS score of 8.8 categorises the flaw as high severity. No EPSS score is available, and it is not listed in the CISA KEV catalog. The bug is exploitable by supplying a crafted Ogg Vorbis file that contains large codebook entries and dimensions. The likely attack vector is remote delivery of a malicious audio file to a program using stb_vorbis. This can trigger out‑of‑bounds heap writes that may crash the process or, in the presence of auxiliary vulnerabilities or an untrusted execution context, lead to arbitrary code execution or denial of service.