CVE-2026-86514

MediumCVSS 6.3

Published: 08/09/2026(UTC)Translated: 08/09/2026(UTC)NVD NIST

Summary

A weakness in vgmstream up to r2117 affects the sscanf function in src/meta/txth.c in the txth-txtp component. This manipulation causes stack-based buffer overflow. The attack can be carried out remotely, and the exploit has been made public. Patch name: 4669d37a6af94866f6f0628678f9f90d46954e8b.

Risk Assessment

Stack-based buffer overflow may allow an attacker to execute arbitrary code or cause system crashes, posing a serious security threat.

Recommendation

Apply patch 4669d37a6af94866f6f0628678f9f90d46954e8b immediately and restrict access to services using vgmstream.

Other vulnerabilities in vgmstream

CVE-2026-86515Medium
A vulnerability in vgmstream up to r2117 affects the add_entry function in src/meta/txtp_parser.c in the txtp component. Manipulation of range_start/range_end arguments leads to resource consumption. The attack can be performed remotely, and the exploit has been disclosed publicly. The patch is named 4b6a02dd1aff6428255db912563d77d4cb0a143e.

Original NVD description (English source)

A weakness has been identified in vgmstream up to r2117. This issue affects the function sscanf of the file src/meta/txth.c of the component txth-txtp. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Patch name: 4669d37a6af94866f6f0628678f9f90d46954e8b. To fix this issue, it is recommended to deploy a patch.