CVE-2023-45680
CVSS 3.1 Score 5.5 of 10 (medium)
Details
Published Oct 21, 2023
Updated: Oct 26, 2023
CWE ID 476
Summary
CVE-2023-45680 is a vulnerability affecting the stb_vorbis library, which is used for processing Ogg Vorbis files. The issue arises when a specially crafted file triggers a memory allocation failure in the 'start_decoder' function. This flaw causes the function to return prematurely and sets the 'f->comment_list' to NULL, while the 'f->comment_list_length' is not reset. In the 'vorbis_deinit' function, the library attempts to dereference the NULL pointer, leading to a denial of service.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.