CVE-2018-1000050: Sean Barrett stb_vorbis version 1.12 and earlier contains a Buffer Overflow vulnerability in All vorbis decodi

Q: How do I fix CVE-2018-1000050?

stb vorbis: upgrade to newer than 1.12. Exact commands for each OS are on this page.

Q: Is CVE-2018-1000050 being exploited?

CVE-2018-1000050 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2018-1000050 affect?

CVE-2018-1000050 affects stb vorbis. Severity is high (CVSS 8.8). Sean Barrett stb_vorbis version 1.12 and earlier contains a Buffer Overflow vulnerability in All vorbis decoding paths. that can result in memory corruption, denial of service, comprised execution of host program. This attack appear to be e

This month

HIGH 8.8UPGRADE

CVE-2018-1000050 is a high-severity flaw (CVSS 8.8) affecting stb vorbis. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Sean Barrett stb_vorbis version 1.12 and earlier contains a Buffer Overflow vulnerability in All vorbis decoding paths. that can result in memory corruption, denial of service, comprised execution of host program. This attack appear to be exploitable via Victim must open a specially crafted Ogg Vorbis file. This vulnerability appears to have been fixed in 1.13.

Why this priority

High severity

A fixed release or distro patch exists.

Risk facts

CVSS score	8.8 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	Required
EPSS exploit chance	1.8% (top 21%)
CISA exploited list	No
Weakness	CWE-119
Published	2018-02-09
Last modified	2026-06-17

Publisher (CNA): MITRE · Vendor: stb vorbis project

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2018-02-09 23:29 UTCPublished CVE record published
2026-06-17 01:32 UTCUpdated Record last modified

stb vorbis project stb vorbis UPGRADE

Affected: <= 1.12

Fixed in: newer than 1.12

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy stb-vorbis || rpm -q stb-vorbis || stb-vorbis --version

2. UPGRADE to newer than 1.12 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade stb-vorbis

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade stb-vorbis

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2018-1000050?

stb vorbis: upgrade to newer than 1.12. Exact commands for each OS are on this page.

Is CVE-2018-1000050 being exploited?

CVE-2018-1000050 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2018-1000050 affect?

CVE-2018-1000050 affects stb vorbis. Severity is high (CVSS 8.8). Sean Barrett stb_vorbis version 1.12 and earlier contains a Buffer Overflow vulnerability in All vorbis decoding paths. that can result in memory corruption, denial of service, comprised execution of host program. This attack appear to be e

How urgent is CVE-2018-1000050?

Priority 51/100. High severity

Related CVEs

CVE-2019-13223 MEDIUM 5.5 UPGRADE MITIGATE A reachable assertion in the lookup1_values function in stb_vorbis through 2019-03-04 allows an attacker to ca
CVE-2019-13222 HIGH 7.1 UPGRADE MITIGATE An out-of-bounds read of a global buffer in the draw_line function in stb_vorbis through 2019-03-04 allows an
CVE-2019-13221 HIGH 7.8 UPGRADE MITIGATE A stack buffer overflow in the compute_codewords function in stb_vorbis through 2019-03-04 allows an attacker
CVE-2019-13220 HIGH 7.1 UPGRADE MITIGATE Use of uninitialized stack variables in the start_decoder function in stb_vorbis through 2019-03-04 allows an
CVE-2019-13219 MEDIUM 5.5 UPGRADE MITIGATE A NULL pointer dereference in the get_window function in stb_vorbis through 2019-03-04 allows an attacker to c

References

← Back to latest CVEs