Hi,

The following vulnerability was published for libstb.

CVE-2026-89266[0]:
| stb_vorbis through 1.22 contains a heap buffer overflow in
| start_decoder() where the codebook multiplicands allocation size is
| truncated from size_t to int. Attackers can craft a malicious Ogg
| Vorbis file with large entries and dimensions values to trigger out-
| of-bounds writes, causing process crashes or heap corruption.

https://github.com/nothings/stb/issues/1928
https://github.com/nothings/stb/issues/1933
https://github.com/nothings/stb/issues/1947


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-89266
https://www.cve.org/CVERecord?id=CVE-2026-89266

Please adjust the affected versions in the BTS as needed.