CVE-2026-89266: Nothings Stb Vorbis

High severity, CVSS 8.2. EPSS: 0.6% chance of exploitation in the next 30 days.

stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook multiplicands allocation size is truncated from size_t to int. Attackers can craft a malicious Ogg Vorbis file with large entries and dimensions values to trigger out-of-bounds writes, causing process crashes or heap corruption.

Affected products

• Nothings Stb Vorbis: up to and including 1.22

Published 2026-09-12. Last modified 2026-09-24.