{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5317", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-01T12:40:12.577Z", "datePublished": "2026-04-02T00:45:13.044Z", "dateUpdated": "2026-04-02T13:11:56.189Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-02T00:45:13.044Z"}, "title": "Nothings stb stb_vorbis.c start_decoder out-of-bounds write", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-787", "lang": "en", "description": "Out-of-bounds Write"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-119", "lang": "en", "description": "Memory Corruption"}]}], "affected": [{"vendor": "Nothings", "product": "stb", "versions": [{"version": "1.0", "status": "affected"}, {"version": "1.1", "status": "affected"}, {"version": "1.2", "status": "affected"}, {"version": "1.3", "status": "affected"}, {"version": "1.4", "status": "affected"}, {"version": "1.5", "status": "affected"}, {"version": "1.6", "status": "affected"}, {"version": "1.7", "status": "affected"}, {"version": "1.8", "status": "affected"}, {"version": "1.9", "status": "affected"}, {"version": "1.10", "status": "affected"}, {"version": "1.11", "status": "affected"}, {"version": "1.12", "status": "affected"}, {"version": "1.13", "status": "affected"}, {"version": "1.14", "status": "affected"}, {"version": "1.15", "status": "affected"}, {"version": "1.16", "status": "affected"}, {"version": "1.17", "status": "affected"}, {"version": "1.18", "status": "affected"}, {"version": "1.19", "status": "affected"}, {"version": "1.20", "status": "affected"}, {"version": "1.21", "status": "affected"}, {"version": "1.22", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in Nothings stb up to 1.22. This affects the function start_decoder of the file stb_vorbis.c. The manipulation results in out-of-bounds write. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-04-01T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-01T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-01T14:45:28.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "d0razi (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/354649", "name": "VDB-354649 | Nothings stb stb_vorbis.c start_decoder out-of-bounds write", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/354649/cti", "name": "VDB-354649 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/780561", "name": "Submit #780561 | nothings stb (stb_vorbis.c) \u2264 1.22 Out-of-bounds Write, Integer Overflow", "tags": ["third-party-advisory"]}, {"url": "https://gist.github.com/d0razi/2ff8a0e812f74dd6fe7f2843931bb90c", "tags": ["exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-02T13:11:33.728292Z", "id": "CVE-2026-5317", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T13:11:56.189Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5317", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-02T13:11:33.728292Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T13:11:46.217Z"}}], "cna": {"title": "Nothings stb stb_vorbis.c start_decoder out-of-bounds write", "credits": [{"lang": "en", "type": "reporter", "value": "d0razi (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "Nothings", "product": "stb", "versions": [{"status": "affected", "version": "1.0"}, {"status": "affected", "version": "1.1"}, {"status": "affected", "version": "1.2"}, {"status": "affected", "version": "1.3"}, {"status": "affected", "version": "1.4"}, {"status": "affected", "version": "1.5"}, {"status": "affected", "version": "1.6"}, {"status": "affected", "version": "1.7"}, {"status": "affected", "version": "1.8"}, {"status": "affected", "version": "1.9"}, {"status": "affected", "version": "1.10"}, {"status": "affected", "version": "1.11"}, {"status": "affected", "version": "1.12"}, {"status": "affected", "version": "1.13"}, {"status": "affected", "version": "1.14"}, {"status": "affected", "version": "1.15"}, {"status": "affected", "version": "1.16"}, {"status": "affected", "version": "1.17"}, {"status": "affected", "version": "1.18"}, {"status": "affected", "version": "1.19"}, {"status": "affected", "version": "1.20"}, {"status": "affected", "version": "1.21"}, {"status": "affected", "version": "1.22"}]}], "timeline": [{"lang": "en", "time": "2026-04-01T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-01T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-01T14:45:28.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/354649", "name": "VDB-354649 | Nothings stb stb_vorbis.c start_decoder out-of-bounds write", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/354649/cti", "name": "VDB-354649 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/780561", "name": "Submit #780561 | nothings stb (stb_vorbis.c) \u2264 1.22 Out-of-bounds Write, Integer Overflow", "tags": ["third-party-advisory"]}, {"url": "https://gist.github.com/d0razi/2ff8a0e812f74dd6fe7f2843931bb90c", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in Nothings stb up to 1.22. This affects the function start_decoder of the file stb_vorbis.c. The manipulation results in out-of-bounds write. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "Out-of-bounds Write"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "Memory Corruption"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-02T00:45:13.044Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5317", "state": "PUBLISHED", "dateUpdated": "2026-04-02T13:11:56.189Z", "dateReserved": "2026-04-01T12:40:12.577Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-02T00:45:13.044Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in Nothings stb up to 1.22. This affects the function start_decoder of the file stb_vorbis.c. The manipulation results in out-of-bounds write. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "id": "CVE-2026-5317", "lastModified": "2026-04-02T01:16:01.847", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}]}, "published": "2026-04-02T01:16:01.847", "references": [{"source": "cna@vuldb.com", "url": "https://gist.github.com/d0razi/2ff8a0e812f74dd6fe7f2843931bb90c"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/780561"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/354649"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/354649/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}, {"lang": "en", "value": "CWE-787"}], "source": "cna@vuldb.com", "type": "Primary"}]}

{"bugzilla": {"description": "nothings stb: Nothings stb: Remote out-of-bounds write vulnerability", "id": "2454179", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454179"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in Nothings stb, a library used for processing audio. A remote attacker can exploit a vulnerability involving an out-of-bounds write within the `start_decoder` function. This issue could allow an attacker to cause the application to crash, disclose sensitive information, or corrupt data. A public exploit for this vulnerability is available."], "mitigation": {"lang": "en:us", "value": "To reduce exposure, avoid processing untrusted audio files with applications that link against the `nothings stb` library. Implement sandboxing for applications that handle external audio input to contain potential impacts."}, "name": "CVE-2026-5317", "public_date": "2026-04-02T00:45:13Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-5317\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-5317\nhttps://gist.github.com/d0razi/2ff8a0e812f74dd6fe7f2843931bb90c\nhttps://vuldb.com/submit/780561\nhttps://vuldb.com/vuln/354649\nhttps://vuldb.com/vuln/354649/cti"], "statement": "This Moderate impact vulnerability in the `stb` library, used for audio processing, allows a remote attacker to trigger an out-of-bounds write. Exploitation of this flaw, for which a public exploit exists, could lead to application crashes, sensitive information disclosure, or data corruption in applications utilizing the affected library. This primarily affects community-supported packages.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.11"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.12"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.13"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.14"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.15"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.16"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.17"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.18"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.19"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.20"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.21"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.22"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "stb", "source": "cna", "vendor": "Nothings"}, "product": "stb", "vendor": "nothings"}], "analysis": {"en": {"generated_at": "2026-04-02T04:22:29.136448+00:00", "value": {"mitigation_remediation": ["Upgrade the stb library to a version newer than 1.22 after a vendor fix is released.", "If an upgrade cannot be performed immediately, isolate or remove usage of stb_vorbis for processing untrusted audio, or execute the decoding in a sandboxed environment.", "Monitor applications for crashes or abnormal memory behavior that may indicate exploitation.", "Keep abreast of Nothings releases and security advisories for a confirmed patch or workaround."], "summary": {"action": "Patch Immediately", "impact": "Remote code execution potential via out-of-bounds write"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Nothings stb library in versions up to 1.22, which is used by many open-source applications that embed stb_vorbis for audio decoding. Any product shipping with these or earlier versions is potentially exposed.", "description_and_impact": "An out-of-bounds write occurs in the start_decoder function of stb_vorbis.c when decoding Vorbis audio data. The flaw can corrupt memory registers and, if triggered by crafted Vorbis streams, potentially allow arbitrary code execution or crash the application. The vulnerability has an attacker able to target a system remotely by providing malicious audio input.", "risk_and_exploitability": "The CVSS score of 5.3 denotes a Medium severity. EPSS data is unavailable, so the precise probability of exploitation is unclear, but the public availability of an exploit and the remote attack surface raise the risk. The issue is not in the CISA KEV catalog; however, without an official patch, the risk remains moderate, with the possibility of denial of service or code execution if memory corruption is leveraged."}}}}, "created": "2026-04-02T07:46:50.411130+00:00", "updated": "2026-04-02T20:15:49.246345+00:00", "vendors": ["nothings", "nothings$PRODUCT$stb"]}