Catalogue CVE

CVE-2026-5317

A security flaw has been discovered in Nothings stb up…

A security flaw has been discovered in Nothings stb up to 1.22. This affects the function start_decoder of the file stb_vorbis.c. The manipulation results in out-of-bounds write. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Gravité: Medium · CVSS 6.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Published: Apr 2, 2026, 12:45:13 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.43% · Oct 27, 2026

Projects and upstream resources

[libstb][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie	libstb	Not reported	AffectedDistribution reports no fix	[CVE-2026-5317]
Debiantrixie	libstb	`0.0~git20241109.5c20573+ds-1`	Affected	[CVE-2026-5317]
Debiansid	libstb	Not reported	AffectedDistribution reports no fix	[CVE-2026-5317]
Debiansid	libstb	`0.0~git20250907.fede005+ds-1`	Affected	[CVE-2026-5317]
Debianforky	libstb	Not reported	AffectedDistribution reports no fix	[CVE-2026-5317]
Debianforky	libstb	`0.0~git20250907.fede005+ds-1`	Affected	[CVE-2026-5317]
Debianbookworm	libstb	Not reported	AffectedDistribution reports no fix	[CVE-2026-5317]
Debianbookworm	libstb	`0.0~git20220908.8b5f1f3+ds-1`	Affected	[CVE-2026-5317]
UnknownRelease not reported	libstb	Not reported	UnknownSource applicability is not established	Provider not reported
UnknownRelease not reported	stb_vorbis.c	Not reported	UnknownSource applicability is not established	Provider not reported

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
UnknownRelease not reported	libstb	Not reported	UnknownSource applicability is not established	Provider not reported
UnknownRelease not reported	stb_vorbis.c	Not reported	UnknownSource applicability is not established	Provider not reported
Debianbookworm	libstb	Not reported	AffectedDistribution reports no fix	[CVE-2026-5317]
Debianbookworm	libstb	`0.0~git20220908.8b5f1f3+ds-1`	Affected	[CVE-2026-5317]
Debianforky	libstb	Not reported	AffectedDistribution reports no fix	[CVE-2026-5317]
Debianforky	libstb	`0.0~git20250907.fede005+ds-1`	Affected	[CVE-2026-5317]
Debiansid	libstb	Not reported	AffectedDistribution reports no fix	[CVE-2026-5317]
Debiansid	libstb	`0.0~git20250907.fede005+ds-1`	Affected	[CVE-2026-5317]
Debiantrixie	libstb	Not reported	AffectedDistribution reports no fix	[CVE-2026-5317]
Debiantrixie	libstb	`0.0~git20241109.5c20573+ds-1`	Affected	[CVE-2026-5317]

Original provider fields

{
  "package_releases": [
    {
      "name": "libstb",
      "status": "vulnerable",
      "release": "sid",
      "version": "0.0~git20250907.fede005+ds-1"
    },
    {
      "name": "libstb",
      "status": "vulnerable",
      "release": "forky",
      "version": "0.0~git20250907.fede005+ds-1"
    },
    {
      "name": "libstb",
      "status": "vulnerable",
      "release": "trixie",
      "version": "0.0~git20241109.5c20573+ds-1"
    },
    {
      "name": "libstb",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "0.0~git20220908.8b5f1f3+ds-1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1134888,
      "name": "libstb",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": 1134888,
      "name": "libstb",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": 1134888,
      "name": "libstb",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": 1134888,
      "name": "libstb",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "libstb",
      "fixed_version": "not yet fixed",
      "applicability_unknown": true
    },
    {
      "name": "stb_vorbis.c",
      "fixed_version": "",
      "applicability_unknown": true
    },
    {
      "name": "stb_vorbis.c",
      "ranges": [
        {
          "fixed": "",
          "introduced": "",
          "last_affected": "1.22",
          "start_excluding": ""
        }
      ],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5317",
      "fixed_version": "",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2026-5317",
      "provider_updated_at": "2026-10-26T22:10:00.163"
    }
  ]
}

[Debian bug #1134888]

Publisher notes

[trixie] libstb: Minor issue [bookworm] libstb: Minor issue

OpenFactory catalog packages

L’association des paquets est en cours.

[Debian 12 (Bookworm)]

[libstb0]Inconnu
Paquet source: [libstb]
Détails (2)
- 0.0~git20220908.8b5f1f3+ds-1 · amd64 · bookworm
  Affectée
  nvd · libstb · debian · bookworm; nvd · libstb · debian · 12
- 0.0~git20220908.8b5f1f3+ds-1 · arm64 · bookworm
  Affectée
  nvd · libstb · debian · bookworm; nvd · libstb · debian · 12
[libstb-dev]Inconnu
Paquet source: [libstb]
Détails (2)
- 0.0~git20220908.8b5f1f3+ds-1 · amd64 · bookworm
  Affectée
  nvd · libstb · debian · bookworm; nvd · libstb · debian · 12
- 0.0~git20220908.8b5f1f3+ds-1 · arm64 · bookworm
  Affectée
  nvd · libstb · debian · bookworm; nvd · libstb · debian · 12

[Debian 13 (Trixie)]

[libstb0t64]Inconnu
Paquet source: [libstb]
Détails (2)
- 0.0~git20241109.5c20573+ds-1 · amd64 · trixie
  Affectée
  nvd · libstb · debian · 13
- 0.0~git20241109.5c20573+ds-1 · arm64 · trixie
  Affectée
  nvd · libstb · debian · 13
[libstb-dev]Inconnu
Paquet source: [libstb]
Détails (2)
- 0.0~git20241109.5c20573+ds-1 · amd64 · trixie
  Affectée
  nvd · libstb · debian · 13
- 0.0~git20241109.5c20573+ds-1 · arm64 · trixie
  Affectée
  nvd · libstb · debian · 13

Observé: Oct 26, 2026, 10:27:08 PM UTC

Références

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]