Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10

Export CSV
CVE-2026-110660

vgmstream through r2117 Stack Out-of-Bounds Read via G.722.1/Siren14 Decoder

vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the G.722.1/Siren14 decoder in g7221_lib.c, whose bit reader refills without checking the data_u32 array end. Attackers can supply crafted .s14 or .sss files that drive decode_vector_quantized_mlt_indices() past the stack buffer during format detection, crashing the application.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Vgmstream
Products
Vgmstream
CVE-2026-105249

vgmstream TXTP File txtp_process.c make_group_random use after free

A weakness has been identified in vgmstream up to r2117. This impacts the function make_group_random of the file src/meta/txtp_process.c of the component TXTP File Handler. This manipulation causes use after free. The attack needs to be launched locally. Patch name: ae37662ad626254ddd96ad69ac263792d7a92024. It is recommended to apply a patch to fix this issue.

CVSS 4.0 · 2.4 Low EPSS < 1% KEV · Not listed
Vendors
Vgmstream
Products
Vgmstream
CVE-2026-105251

vgmstream VAG File psx_decoder.c ps_find_padding out-of-bounds

A vulnerability was detected in vgmstream up to r2117. Affected by this vulnerability is the function ps_find_padding of the file src/coding/psx_decoder.c of the component VAG File Handler. Performing a manipulation results in out-of-bounds read. The attack is possible to be carried out remotely. The patch is named 4b8316652a30d40f99ad43310bed273fd1f8a7a3. It is suggested to install a patch to address this issue.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Vgmstream
Products
Vgmstream
CVE-2026-105250

vgmstream Microsoft IMA Decoder ima_decoder.c decode_ms_ima divide by zero

A security vulnerability has been detected in vgmstream up to r2117. Affected is the function decode_ms_ima of the file src/coding/ima_decoder.c of the component Microsoft IMA Decoder. Such manipulation leads to divide by zero. The attack can be executed remotely.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Vgmstream
Products
Vgmstream
CVE-2026-105248

vgmstream TXTP File txtp_parser.c txtp_parse out-of-bounds write

A security flaw has been discovered in vgmstream up to r2117. This affects the function parse_params/txtp_parse of the file src/meta/txtp_parser.c of the component TXTP File Handler. The manipulation results in out-of-bounds write. The attack may be launched remotely. The patch is identified as 4669d37a6af94866f6f0628678f9f90d46954e8b. It is best practice to apply a patch to resolve this issue.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Vgmstream
Products
Vgmstream
CVE-2026-92881

vgmstream AWB parser awb.c init_vgmstream_awb_memory divide by zero

A security vulnerability has been detected in vgmstream. The affected element is the function init_vgmstream_awb_memory of the file src/meta/awb.c of the component AWB parser. Such manipulation leads to divide by zero. The attack can be executed remotely. The name of the patch is ae37662ad626254ddd96ad69ac263792d7a92024. A patch should be applied to remediate this issue.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Vgmstream
Products
Vgmstream
CVE-2026-92880

vgmstream EA SCHl parser vadpcm_decoder.c vadpcm_read_coefs_be out-of-bounds write

A weakness has been identified in vgmstream up to r2117. Impacted is the function vadpcm_read_coefs_be of the file src/coding/vadpcm_decoder.c of the component EA SCHl parser. This manipulation of the argument entry/entries causes out-of-bounds write. Remote exploitation of the attack is possible. Patch name: ae37662ad626254ddd96ad69ac263792d7a92024. It is suggested to install a patch to address this issue.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Vgmstream
Products
Vgmstream
CVE-2026-92879

vgmstream mus_acm.c parse_mus resource consumption

A security flaw has been discovered in vgmstream up to r2117. This issue affects the function parse_mus of the file src/meta/mus_acm.c. The manipulation results in resource consumption. The attack may be launched remotely. The patch is identified as ae37662ad626254ddd96ad69ac263792d7a92024. Applying a patch is advised to resolve this issue.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Vgmstream
Products
Vgmstream
CVE-2026-86514

vgmstream txth-txtp txth.c sscanf stack-based overflow

A weakness has been identified in vgmstream up to r2117. This issue affects the function sscanf of the file src/meta/txth.c of the component txth-txtp. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Patch name: 4669d37a6af94866f6f0628678f9f90d46954e8b. To fix this issue, it is recommended to deploy a patch.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Vgmstream
Products
Vgmstream
CVE-2026-86515

vgmstream txtp txtp_parser.c add_entry resource consumption

A security vulnerability has been detected in vgmstream up to r2117. Impacted is the function add_entry of the file src/meta/txtp_parser.c of the component txtp. Such manipulation of the argument range_start/range_end leads to resource consumption. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The name of the patch is 4b6a02dd1aff6428255db912563d77d4cb0a143e. It is advisable to implement a patch to correct this issue.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Vgmstream
Products
Vgmstream