CVE-2026-92879
MediumCVSS 4.3Summary
A security flaw has been discovered in vgmstream up to r2117. This issue affects the function parse_mus of the file src/meta/mus_acm.c. The manipulation results in resource consumption. The attack may be launched remotely. The patch is identified as ae37662ad626254ddd96ad69ac263792d7a92024.
Risk Assessment
A remote attacker can cause excessive resource consumption, potentially leading to denial of service or destabilization of the application processing audio files. The risk affects system availability.
Recommendation
Apply patch ae37662ad626254ddd96ad69ac263792d7a92024 to resolve the resource consumption issue in vgmstream. Update the library to a version containing this patch.
Other vulnerabilities in vgmstream
See all- CVE-2026-92881Medium
A security vulnerability has been detected in vgmstream. The affected element is the function init_vgmstream_awb_memory of the file src/meta/awb.c of the component AWB parser. Such manipulation leads to divide by zero. The attack can be executed remotely. The name of the patch is ae37662ad626254ddd96ad69ac263792d7a92024. A patch should be applied to remediate this issue.
- CVE-2026-92880Medium
In vgmstream up to r2117, the vadpcm_read_coefs_be function in src/coding/vadpcm_decoder.c (EA SCHl parser component) mishandles the entry/entries argument, causing an out-of-bounds write. Remote exploitation is possible. A patch named ae37662ad626254ddd96ad69ac263792d7a92024 is available.
- CVE-2026-86515Medium
A vulnerability in vgmstream up to r2117 affects the add_entry function in src/meta/txtp_parser.c in the txtp component. Manipulation of range_start/range_end arguments leads to resource consumption. The attack can be performed remotely, and the exploit has been disclosed publicly. The patch is named 4b6a02dd1aff6428255db912563d77d4cb0a143e.
- CVE-2026-86514Medium
A weakness in vgmstream up to r2117 affects the sscanf function in src/meta/txth.c in the txth-txtp component. This manipulation causes stack-based buffer overflow. The attack can be carried out remotely, and the exploit has been made public. Patch name: 4669d37a6af94866f6f0628678f9f90d46954e8b.
Original NVD description (English source)
A security flaw has been discovered in vgmstream up to r2117. This issue affects the function parse_mus of the file src/meta/mus_acm.c. The manipulation results in resource consumption. The attack may be launched remotely. The patch is identified as ae37662ad626254ddd96ad69ac263792d7a92024. Applying a patch is advised to resolve this issue.