Description
A weakness has been identified in vgmstream up to r2117. This impacts the function make_group_random of the file src/meta/txtp_process.c of the component TXTP File Handler. This manipulation causes use after free. The attack needs to be launched locally. Patch name: ae37662ad626254ddd96ad69ac263792d7a92024. It is recommended to apply a patch to fix this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | vgmstream | r2117 | — |
References
- VDB-413456 | vgmstream TXTP File txtp_process.c make_group_random use after free vdb-entry technical-description
- VDB-413456 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-105249 | CVE Analysis and Report third-party-advisory
- Submit #976279 | vgmstream r2117 Use After Free third-party-advisory
- https://github.com/vgmstream/vgmstream/issues/1998 issue-tracking
- https://github.com/vgmstream/vgmstream/pull/2008 issue-tracking patch
- https://github.com/vgmstream/vgmstream/commit/ae37662ad626254ddd96ad69ac263792d7a92024 patch
- https://github.com/vgmstream/vgmstream/ product