A security flaw has been discovered in Nothings stb up to 1.22. This affects the function start_decoder of the file stb_vorbis.c. The manipulation results in out-of-bounds write. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
References
| Link | Resource |
|---|---|
| https://gist.github.com/d0razi/2ff8a0e812f74dd6fe7f2843931bb90c | Exploit Third Party Advisory |
| https://vuldb.com/submit/780561 | Third Party Advisory VDB Entry |
| https://vuldb.com/vuln/354649 | Third Party Advisory VDB Entry |
| https://vuldb.com/vuln/354649/cti | Permissions Required VDB Entry |
Configurations
History
30 Apr 2026, 20:28
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Nothings stb Vorbis.c
Nothings |
|
| CPE | cpe:2.3:a:nothings:stb_vorbis.c:*:*:*:*:*:*:*:* | |
| References | () https://gist.github.com/d0razi/2ff8a0e812f74dd6fe7f2843931bb90c - Exploit, Third Party Advisory | |
| References | () https://vuldb.com/submit/780561 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/vuln/354649 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/vuln/354649/cti - Permissions Required, VDB Entry |
02 Apr 2026, 01:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-02 01:16
Updated : 2026-04-30 20:28
NVD link : CVE-2026-5317
Mitre link : CVE-2026-5317
CVE.ORG link : CVE-2026-5317
JSON object : View
Products Affected
nothings
- stb_vorbis.c