DEBIAN-CVE-2026-89266

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-89266
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-89266.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-89266
Upstream
  • CVE-2026-89266
Published
2026-09-12T00:17:06Z
Modified
2026-09-12T11:00:08Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H CVSS Calculator
Summary
[none]
Details

stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook multiplicands allocation size is truncated from size_t to int. Attackers can craft a malicious Ogg Vorbis file with large entries and dimensions values to trigger out-of-bounds writes, causing process crashes or heap corruption.

References

Affected packages

Debian:12 / libstb

Package

Name
libstb
Purl
pkg:deb/debian/libstb?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.0~git20220908.8b5f1f3+ds-1
0.0~git20230129.5736b15+ds-1
0.0~git20230129.5736b15+ds-1.1~exp1
0.0~git20230129.5736b15+ds-1.1
0.0~git20230129.5736b15+ds-1.2
0.0~git20240715.f7f20f39fe4f+ds-1
0.0~git20241109.5c20573+ds-1
0.0~git20250907.fede005+ds-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-89266.json"

Debian:13 / libstb

Package

Name
libstb
Purl
pkg:deb/debian/libstb?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.0~git20241109.5c20573+ds-1
0.0~git20250907.fede005+ds-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-89266.json"

Debian:14 / libstb

Package

Name
libstb
Purl
pkg:deb/debian/libstb?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.0~git20241109.5c20573+ds-1
0.0~git20250907.fede005+ds-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-89266.json"