This vulnerability in the Nothings stb library affects the start_decoder function of the stb_vorbis.c source file, causing an out-of-bounds write condition. The issue exists in all versions up to 1.22. The vulnerability can be exploited remotely and requires user interaction to trigger. The CVSS 4.0 base score is 5.3, indicating medium severity. The vendor has not provided any advisory or patch, and the exploit code is publicly available.

Successful exploitation of this vulnerability may allow an attacker to perform an out-of-bounds write, potentially leading to memory corruption. This could result in application crashes or other unintended behavior. The vulnerability requires user interaction and has low to limited impact on confidentiality, integrity, and availability according to the CVSS vector. No evidence of exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official patch or workaround is available, users should consider avoiding use of affected versions or applying manual code review and hardening around the start_decoder function. Monitor for any future vendor advisories or community patches addressing this issue.