A heap buffer overflow vulnerability in the stb_vorbis library, affecting versions 0 through 1.22, poses a significant risk of process crashes and potential heap corruption when processing malicious files.

This is an out-of-bounds write vulnerability (CWE-787) triggered by a size truncation error during the allocation of codebook multiplicands in the start_decoder function. The vulnerability is exploitable by an unauthenticated attacker providing a specially crafted Ogg Vorbis file.

The exploitation of this vulnerability can result in significant service disruption due to process crashes, which may impact applications relying on this library for audio decoding. While the primary impact is denial of service, heap corruption vulnerabilities can potentially lead to arbitrary code execution in specific environments, justifying the high CVSS score of 8.2.

Immediate Action: Since no official patch version is currently identified, developers should audit their integration of stb_vorbis and implement input validation to reject malformed Ogg Vorbis files until an upstream security update is released.

Proactive Monitoring: Security teams should monitor application logs for unexpected crashes or error signals originating from the audio decoding module.

Compensating Controls: Deploy file integrity checks or sandbox the audio decoding process to limit the impact of potential memory corruption to an isolated environment.

Public Exploit Available: Unknown.

Given the severity of heap-based memory corruption, organizations utilizing the stb_vorbis library must prioritize this issue. Until the vendor provides a formal patch, implement strict validation of all Ogg Vorbis input files and ensure that audio processing components are executed with the least privilege necessary to mitigate potential system-wide compromise.