Vulnerabilities > CVE-2023-45680 - NULL Pointer Dereference vulnerability in Nothings STB Vorbis.C 1.22
Attack vector
LOCAL Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
NONE Availability impact
HIGH Summary
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory allocation failure in `start_decoder`. In that case the function returns early, the `f->comment_list` is set to `NULL`, but `f->comment_list_length` is not reset. Later in `vorbis_deinit` it tries to dereference the `NULL` pointer. This issue may lead to denial of service.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 1 |