CVE-2026-105248

A security flaw has been discovered in vgmstream up to r2117. This issue affects the function parse_mus of the file src/meta/mus_acm.c. The manipulation results in resource consumption. The attack may be launched remotely. The patch is identified as ae37662ad626254ddd96ad69ac263792d7a92024.

vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the G.722.1/Siren14 decoder in g7221_lib.c, whose bit reader refills without checking the data_u32 array end. Attackers can supply crafted .s14 or .sss files that drive decode_vector_quantized_mlt_indices() past the stack buffer during format detection, crashing the application.

A vulnerability was detected in vgmstream up to r2117. The function ps_find_padding in the file src/coding/psx_decoder.c of the VAG File Handler component is affected. Manipulation results in an out-of-bounds read. The attack can be carried out remotely. A patch is available.

In the vgmstream library up to revision r2117, a vulnerability was found in the decode_ms_ima function in src/coding/ima_decoder.c (Microsoft IMA Decoder component). Manipulation leads to a divide by zero, and the attack can be executed remotely.

In the vgmstream library up to revision r2117, a weakness was found in the make_group_random function in src/meta/txtp_process.c (TXTP File Handler component). This manipulation causes a use-after-free, and the attack needs to be launched locally. Patch name: ae37662ad626254ddd96ad69ac263792d7a92024.

A security vulnerability has been detected in vgmstream. The affected element is the function init_vgmstream_awb_memory of the file src/meta/awb.c of the component AWB parser. Such manipulation leads to divide by zero. The attack can be executed remotely. The name of the patch is ae37662ad626254ddd96ad69ac263792d7a92024. A patch should be applied to remediate this issue.

In vgmstream up to r2117, the vadpcm_read_coefs_be function in src/coding/vadpcm_decoder.c (EA SCHl parser component) mishandles the entry/entries argument, causing an out-of-bounds write. Remote exploitation is possible. A patch named ae37662ad626254ddd96ad69ac263792d7a92024 is available.

A vulnerability in vgmstream up to r2117 affects the add_entry function in src/meta/txtp_parser.c in the txtp component. Manipulation of range_start/range_end arguments leads to resource consumption. The attack can be performed remotely, and the exploit has been disclosed publicly. The patch is named 4b6a02dd1aff6428255db912563d77d4cb0a143e.

A weakness in vgmstream up to r2117 affects the sscanf function in src/meta/txth.c in the txth-txtp component. This manipulation causes stack-based buffer overflow. The attack can be carried out remotely, and the exploit has been made public. Patch name: 4669d37a6af94866f6f0628678f9f90d46954e8b.