CVE-2023-45680
CVSS 3.1 Score 5.3 of 10 (medium)
Details
Summary
CVE-2023-45680 is a vulnerability affecting the stb_vorbis library, a single file MIT licensed library used for processing ogg vorbis files. The vulnerability occurs when a crafted file triggers a memory allocation failure in the `start_decoder` function, leading to a denial of service. This issue occurs because the `f->comment_list` is set to `NULL` but `f->comment_list_length` is not reset. As a result, when the `vorbis_deinit` function tries to dereference the `NULL` pointer, it can potentially cause the application to crash or become unresponsive. This vulnerability has a base severity of MEDIUM and an exploitability score of 3.9 out of 10, indicating that it poses a moderate risk to organizations using the affected library. To remediate this vulnerability, users should update their stb_vorbis library to a version that includes a fix for this issue.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions