A weakness has been identified in vgmstream up to r2117. This impacts the function make_group_random of the file src/meta/txtp_process.c of the component TXTP File Handler. This manipulation causes use after free.
The attack needs to be launched locally. Patch name: ae37662ad626254ddd96ad69ac263792d7a92024. It is recommended to apply a patch to fix this issue.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
Passive
Minimal interaction
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
n/a:vgmstream
References 8
https://vuldb.com/vuln/413456
VDB-413456 | vgmstream TXTP File txtp_process.c make_group_random use after free
https://vuldb.com/vuln/413456/cti
VDB-413456 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/cve/CVE-2026-105249
CVE-2026-105249 | CVE Analysis and Report
https://vuldb.com/submit/976279
Submit #976279 | vgmstream r2117 Use After Free
https://github.com/vgmstream/vgmstream/issues/1998
NVD
https://github.com/vgmstream/vgmstream/pull/2008
NVD
https://github.com/vgmstream/vgmstream/commit/ae37662ad626254ddd96ad69ac263792d…
NVD
https://github.com/vgmstream/vgmstream/
NVD