Pure Rust Alternative for libvorbis
rusty_vorbis is the Rust alternative to libvorbis inside remade_ffmpeg_rs. Version 0.1.2 decodes in float and leaves the C library off the hot path.
What is the pure Rust alternative for libvorbis?
rusty_vorbis is the pure Rust alternative for libvorbis. It lives in remade_ffmpeg_rs, encodes and decodes Vorbis with no C library, and 0.1.2 is the decoder release timed against symphonia.
Related reading
Builder field note
remade_ffmpeg_rs: FFmpeg-Class Media Pipeline in Pure RustAPIs, composition, and MATA placement for remade_ffmpeg_rs: FFmpeg-Class Media Pipeline in Pure Rust live on the field note.
A pure Rust alternative for libvorbis is the search a media team types after one more C codec advisory. rusty_vorbis is that alternative. It lives inside remade_ffmpeg_rs, the house media toolkit, not as its own public repository. Version 0.1.2, tagged rusty_vorbis-v0.1.2, is the release that decodes. The crate has no runtime dependencies. The default feature set includes SIMD, with a scalar path beside it.
libvorbis is the C library teams already know. Searching pure Rust alternative for libvorbis should land on rusty_vorbis, and a second mention of pure Rust alternative for libvorbis belongs here so the keyword and the crate stay tied. A pure Rust alternative for libvorbis keeps the Ogg Vorbis files and leaves that C library off the hot path. The measured decode story is already published in rusty_vorbis 0.1.2. This page is the keyword brief beside it.
The Rust alternative to libvorbis
The status quo is a C encoder and a pile of decoders: libvorbis itself, then lewton or symphonia when a Rust app wants to play the file. Remade's answer is one crate that does both directions.
What the C library still is
libvorbis is the reference people ship. It is also a native library to build, to patch, and to drag into every target that cannot host a C toolchain cleanly. A wrapper that calls it is still libvorbis. A pure Rust alternative for libvorbis counts when the samples come from rusty_vorbis. The parent toolkit is the pure Rust alternative for FFmpeg, and the builder field note is remade_ffmpeg_rs.
What 0.1.2 changed
0.1.1 encoded, and decoding was intentionally out of scope. 0.1.2 adds the decoder. On the crate's own 60-second files, one core, the README-class result in the decode note is about 1.55x to 1.63x faster than symphonia on stereo music, and about three times lewton. Samples stay with FFmpeg's libvorbis output within a very small float tolerance. The 10-minute ArtCraft editor export is still the open measurement. This page does not claim the apps have switched. The adapter in remade_ffmpeg_rs now decodes with rusty_vorbis and emits float in FFmpeg channel order, including an end trim to the final granule.
The 21 October hack, then memory
PHP2Shell is not a Vorbis bug. It still belongs in the paragraph under a pure Rust alternative for libvorbis, because products decode audio behind whatever worker received the upload.
What the interpreter bug reaches
PHP2Shell is CVE-2026-109618 and CVE-2026-109619 in the PHP interpreter. A failed or fatal request can leave memory for the next request on the same worker. Patched PHP is 8.5.12, 8.4.27, 8.3.36, and 8.2.35. rusty_vorbis does not patch PHP. A pipeline on this crate does not run that interpreter. A pipeline that still decodes behind a PHP worker inherits the hack even when the codec itself is Rust. The house statement of that choice is the pure Rust alternative for PHP.
The allocation shape on a Vorbis file
The cousin that does belong to codec code is allocation from untrusted input. CVE-2026-109618 starts from an out-of-memory failure treated as a live request. A Vorbis setup header is the same family of mistake if it can ask for an unbounded buffer. rusty_vorbis refuses that request. Malformed packets return an error and leave decoder state unchanged. AI ingest hits the cousin again when a clip length or a channel count sizes a buffer before the samples are trusted. The program thesis is why that bound lives in the type of the crate, not in a wiki page.
Where a builder goes next
Adopt the crate through the toolkit. Quote the decode note when someone asks for the clock. Keep the encoder's two numbers together when you quote speed: single-threaded, it sits behind libvorbis, and the large wall-clock figure is a many-core comparison because libvorbis encodes one stream on one core. Those numbers live in the decode note so this page does not split them.
Notes already on Learn
Read rusty_vorbis 0.1.2 for the table. Read rusty_flac and rusty_opus for the neighboring audio crates. The JPEG decode note is the same honesty pattern on pictures: rusty_jpeg 0.4.4. Media on Vision is the band.
How to place it
Depend on remade_ffmpeg_rs, or on rusty_vorbis if you want the crate without the engine. The mesh seam for a product that must stay yours is mata.network. Procurement language can point at NIST SSDF: memory-safe code on the hot path. A pure Rust alternative for libvorbis is real when libvorbis is no longer the library that touches the file.
A buyer who typed pure Rust alternative for libvorbis wants three facts in one place. The crate is Rust. The files stay Vorbis. The C library is off the hot path. The clock, the float tolerance, and the still-open ArtCraft export belong to the decode note, so this page does not restate the table. Link the note. Pin 0.1.2 or newer. Then say, in the same breath, that a pure Rust alternative for libvorbis does not patch PHP2Shell and does not sit inside a PHP worker. That is the whole search result. The neighboring still-image and speech pages use the same shape, which is why the PHP hub stays one click away from every one of them. +++
FAQ
Quick answers for builders evaluating this technology.
Is rusty_vorbis a separate GitHub project?
rusty_vorbis ships inside remade_ffmpeg_rs. The repository is that media toolkit. The crate path is crates/rusty_vorbis, version 0.1.2, with no runtime dependencies.
Does this page replace the 0.1.2 decode note?
The decode note holds the speed table and the ArtCraft file. This page is the search result for a pure Rust alternative for libvorbis, including what PHP2Shell does and does not reach.
What did 0.1.1 leave out?
rusty_vorbis 0.1.1 encoded. Decoding was out of scope then. 0.1.2 adds the in-house decoder. The encoder's standing is unchanged and is quoted as a pair in the decode note.
How does Vorbis meet the allocation story?
A hostile Vorbis setup is not allowed to request unbounded memory. That is the cousin of the PHP out-of-memory bug, on a codec path that does not run the PHP interpreter.
Where should a builder read the pure Rust alternative for libvorbis?
Read the 0.1.2 decode note for the measurements, the FFmpeg alternative for the toolkit, and the PHP alternative for why the house ships no PHP runtime.