CVE-2026-92880
MediumCVSS 6.3Summary
In vgmstream up to r2117, the vadpcm_read_coefs_be function in src/coding/vadpcm_decoder.c (EA SCHl parser component) mishandles the entry/entries argument, causing an out-of-bounds write. Remote exploitation is possible. A patch named ae37662ad626254ddd96ad69ac263792d7a92024 is available.
Risk Assessment
A remote attacker could cause memory corruption, potentially enabling code execution or crashing the application that processes malicious audio files. The risk affects systems handling untrusted EA SCHl files.
Recommendation
Install the available patch ae37662ad626254ddd96ad69ac263792d7a92024 or upgrade vgmstream to a version containing the fix. Avoid processing untrusted audio files until patched.
Other vulnerabilities in vgmstream
See all- CVE-2026-92881Medium
A security vulnerability has been detected in vgmstream. The affected element is the function init_vgmstream_awb_memory of the file src/meta/awb.c of the component AWB parser. Such manipulation leads to divide by zero. The attack can be executed remotely. The name of the patch is ae37662ad626254ddd96ad69ac263792d7a92024. A patch should be applied to remediate this issue.
- CVE-2026-92879Medium
A security flaw has been discovered in vgmstream up to r2117. This issue affects the function parse_mus of the file src/meta/mus_acm.c. The manipulation results in resource consumption. The attack may be launched remotely. The patch is identified as ae37662ad626254ddd96ad69ac263792d7a92024.
- CVE-2026-86515Medium
A vulnerability in vgmstream up to r2117 affects the add_entry function in src/meta/txtp_parser.c in the txtp component. Manipulation of range_start/range_end arguments leads to resource consumption. The attack can be performed remotely, and the exploit has been disclosed publicly. The patch is named 4b6a02dd1aff6428255db912563d77d4cb0a143e.
- CVE-2026-86514Medium
A weakness in vgmstream up to r2117 affects the sscanf function in src/meta/txth.c in the txth-txtp component. This manipulation causes stack-based buffer overflow. The attack can be carried out remotely, and the exploit has been made public. Patch name: 4669d37a6af94866f6f0628678f9f90d46954e8b.
Original NVD description (English source)
A weakness has been identified in vgmstream up to r2117. Impacted is the function vadpcm_read_coefs_be of the file src/coding/vadpcm_decoder.c of the component EA SCHl parser. This manipulation of the argument entry/entries causes out-of-bounds write. Remote exploitation of the attack is possible. Patch name: ae37662ad626254ddd96ad69ac263792d7a92024. It is suggested to install a patch to address this issue.