Description
A security flaw has been discovered in vgmstream up to r2117. This affects the function parse_params/txtp_parse of the file src/meta/txtp_parser.c of the component TXTP File Handler. The manipulation results in out-of-bounds write. The attack may be launched remotely. The patch is identified as 4669d37a6af94866f6f0628678f9f90d46954e8b. It is best practice to apply a patch to resolve this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | vgmstream | r2117 | — |
References
- VDB-413455 | vgmstream TXTP File txtp_parser.c txtp_parse out-of-bounds write vdb-entry technical-description
- VDB-413455 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-105248 | CVE Analysis and Report third-party-advisory
- Submit #976278 | vgmstream r2117 Buffer Overflow third-party-advisory
- https://github.com/vgmstream/vgmstream/issues/1997 issue-tracking
- https://github.com/vgmstream/vgmstream/commit/4669d37a6af94866f6f0628678f9f90d46954e8b patch
- https://github.com/vgmstream/vgmstream/ product