CVE-2026-5316: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-5316 is an invalid free / uncontrolled resource consumption vulnerability in the setup_free() function of stb_vorbis.c, part of the nothings/stb single-file library collection. It affects all versions of stb_vorbis.c up to and including 1.22. When processing a malformed Ogg Vorbis file, corrupted internal state from a malformed setup header causes an invalid pointer to be passed to free(), resulting in a crash. The vulnerability was disclosed on April 2, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Feedly). The vendor was contacted prior to disclosure but did not respond (GitHub Advisory).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling), with the PoC gist also labeling it CWE-761 (Free of Pointer not at Start of Buffer) (PoC Gist, GitHub Advisory). During Ogg Vorbis decoding, stb_vorbis_open_memory() calls vorbis_deinit() on error, which in turn calls setup_free() with a pointer derived from corrupted internal decoder state — specifically from a malformed setup header — causing an invalid free() and a segmentation fault. The attack vector is network-based and requires user interaction (e.g., a user or application opening a crafted .ogg file), with no privileges required. A public PoC (repro.c + base64-encoded poc.ogg) is available and triggers an AddressSanitizer SEGV in __asan::Allocator::Deallocate → free → setup_free (stb_vorbis.c:966) → vorbis_deinit (stb_vorbis.c:4214) (PoC Gist).

Successful exploitation causes the application using stb_vorbis.c to crash (denial of service), with no impact on confidentiality or integrity. Any application that processes untrusted Ogg Vorbis audio using stb_vorbis.c — including games, media players, and embedded audio tools — is at risk of being crashed by a crafted audio file. There is no evidence of lateral movement potential or data exposure; the impact is limited to availability of the affected process (Feedly, GitHub Advisory).

A public proof-of-concept exploit is available on GitHub, consisting of a C reproducer (repro.c) and a base64-encoded malformed Ogg Vorbis file that reliably triggers the crash (PoC Gist). There is no evidence of in-the-wild exploitation or threat actor attribution at this time (Feedly). The EPSS score is approximately 0.033% (per Feedly) to 0.189% (per GitHub Advisory), indicating low but non-zero exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Obtain the PoC: Download the public PoC from the GitHub Gist (https://gist.github.com/d0razi/cc7f70bba08c1a455d9933e97b8b57c1), which includes gist_09_repro.c, gist_09_poc.b64, and gist_09_README.md.
2. Prepare the malformed Ogg file: Decode the base64-encoded payload: base64 -d poc.ogg.b64 > poc.ogg. This produces a crafted Ogg Vorbis file with a malformed setup header that corrupts internal decoder state.
3. Compile the reproducer: Build the test harness against the vulnerable stb_vorbis.c: clang -fsanitize=address -g -O0 repro.c -o repro -lm (requires stb_vorbis.c ≤ 1.22 in the same directory).
4. Trigger the crash: Run ./repro poc.ogg. The malformed file causes stb_vorbis_decode_memory() to invoke vorbis_deinit() → setup_free() with an invalid pointer, resulting in a SEGV/crash.
5. Real-world delivery: In a real attack scenario, deliver the crafted .ogg file to a target application (e.g., via a malicious download, media upload endpoint, or network stream) that uses stb_vorbis.c for audio decoding, causing the application to crash upon processing the file (PoC Gist).

• File System: Presence of crafted .ogg files with malformed setup headers in application input directories or temporary folders; unexpected core dump files generated by the application process.
• Logs: Application crash logs or error reports referencing stb_vorbis, setup_free, vorbis_deinit, or stb_vorbis_open_memory; AddressSanitizer output showing SEGV on unknown address in free() → setup_free (stb_vorbis.c:966).
• Process: Unexpected termination (crash) of applications that process audio files, particularly when handling externally supplied .ogg files; repeated process restarts by a supervisor/watchdog following audio file processing (PoC Gist).

Update stb_vorbis.c to a version after 1.22 by pulling the latest commit from the nothings/stb repository, as a patch is referenced in the GitHub Advisory (GitHub Advisory). If immediate patching is not feasible, restrict network access to applications that process Ogg Vorbis audio using the affected library, and implement strict input validation or sandboxing for audio file processing. Applications should avoid processing untrusted Ogg Vorbis files until the library is updated (Feedly).

The vulnerability was assigned by VulDB and published to the GitHub Advisory Database on April 2, 2026, with a moderate severity rating. The vendor (nothings) did not respond to the coordinated disclosure attempt (GitHub Advisory). No significant broader media coverage or notable researcher commentary beyond the initial PoC publication has been identified.