Out Of Bounds Read

2023-10-2606:13:24

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

stb_vorbis

out of bounds read

vulnerability

ogg vorbis

decode macro

attacker

crafting file

memory allocation

CVSS3

7.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

AI Score

6.9

Confidence

High

EPSS

0.001

Percentile

18.9%

JSON

stb_vorbis is vulnerable to Out of bounds Read.The vulnerability is due to the processing of ogg vorbis files using the DECODE macro. This can be exploited by the attacker by crafting a file that triggers an out of bounds read when the var is negative thus resulting in leakage of internal memory allocation.