In sbc versions 1.0 through 2.0 (upstream HEAD 2.2), sbc_unpack_frame_internal() in sbc/sbc.c has an off-by-one error in the per-sample bit-reader bound check. At line 502 (v2.0) / 509 (v1.0), the guard `if (consumed > len * 8)` uses `>` instead of `>=`, allowing the cumulative bit position `consumed` to reach exactly `len * 8`. The next statement indexes `data[consumed >> 3]` which equals `data[len]`, reading one byte past the end of the input buffer.

A 14-byte attacker-controlled SBC payload triggers the over-read deterministically. AddressSanitizer reports a heap-buffer-overflow at the read site. The bug was introduced in commit feb1bd57 (2011-10-19) and affects every release since.

The vulnerable decode path is the public sbc_decode() entry point, called by all SBC audio consumers: PulseAudio Bluetooth module, PipeWire Bluetooth module, ofono, GStreamer sbcparse/sbcdec plugins, and any application linking libsbc directly. SBC is the mandatory A2DP codec, so the attack surface includes any device that decodes Bluetooth audio.