Threats affecting pkg:github/stb_vorbis

CVE-2026-89266 is a heap buffer overflow vulnerability in the stb_vorbis library version 1.22 and earlier. The flaw occurs in the start_decoder() function due to truncation of the allocation size from size_t to int for codebook multiplicands. This can be exploited by a crafted malicious Ogg Vorbis file with large entries and dimensions, leading to out-of-bounds writes that may cause process crashes or heap corruption.