EUVD-2026-92277
GHSA-3mmp-rh6q-jfhh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malformed Microsoft IMA file
-
DeliveryDeliver file to victim
-
ExploitVictim opens file in vgmstream
-
ExecutionDivisor reaches zero in decode_ms_ima
-
ImpactDivide-by-zero crashes application
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Division safety checks
|
| Exploitation Conditions | Exploitation requires that a victim open or play an attacker-supplied malformed Microsoft IMA ADPCM-encoded audio file (vgmstream builds up to r2117) in an application that uses vgmstream for decoding; the divide-by-zero is reached inside decode_ms_ima during parsing of that specific codec path. Limiting factors: the attack needs user interaction (UI:P) - the file must be actively loaded/played - and the impact is confined to a crash of the decoding process with no code execution, data exposure, or integrity effect. There is no server-side or unattended trigger. |
| Impact | This is a moderate-severity denial-of-service issue, not a high-priority emergency. The input CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P/VC:N/VI:N/VA:L) scores 5.3 and is internally consistent: the only impact is availability-low (a crash), with no confidentiality or integrity effect, and it requires passive user interaction (UI:P) - the victim must open or play a crafted audio file. CWE-369 (divide by zero) in decode_ms_ima matches an availability-only crash. No EPSS score, KEV listing, or POC is present in the supplied data, so exploitation probability signals are entirely absent - per the precision rules this is 'no public exploit identified at time of analysis.' The 'remote' label reflects that a malicious file can be delivered over a network, but exploitation still depends on the user feeding that file to a vgmstream-based player; this is not remote-unauthenticated server compromise. Note two likely-mislabeled input tags: 'Microsoft' (vgmstream is an independent open-source project; 'Microsoft IMA' is only the ADPCM codec format name) and 'Information Disclosure' (the actual impact per CWE-369 and VA:L is a crash, not data disclosure). Overall: a real but low-impact robustness bug in a niche library, appropriate for routine patching rather than urgent response. |
| Exploit ScenarioDerived | An attacker crafts a malformed Microsoft IMA ADPCM audio file with a header field that drives a divisor to zero in decode_ms_ima and distributes it (e.g., as a game rip or audio download). When a victim opens or plays the file in a vgmstream-based player or plugin, the divide-by-zero triggers and the application crashes. No public exploit code is identified in the provided data, and impact is limited to denial of service. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
A divide-by-zero fault in vgmstream's Microsoft IMA ADPCM decoder (decode_ms_ima in src/coding/ima_decoder.c) allows an attacker to crash an application that uses the library by tricking a user into opening or playing a malformed IMA ADPCM-encoded audio file. All builds up to and including r2117 are affected, and the issue is reachable remotely only in the sense that the hostile file can be delivered over a network - the victim must still actively load it into a vgmstream-based player or tool, and the CVSS vector confirms the attack is unauthenticated but requires user interaction. Impact is limited to denial of service: the decoder process aborts with no code execution, data disclosure, or integrity loss, and there is no public exploit identified at time of analysis, so this is best treated as a moderate-severity availability bug rather than an emergency.
RemediationAI
No vendor-released patch identified at time of analysis - no fixed version, commit hash, or tagged release is provided in the available intelligence, so the recommended first step is to track https://github.com/vgmstream/vgmstream/issues/1999 and the upstream repository at https://github.com/vgmstream/vgmstream/ for a fix commit or a build newer than r2117 and upgrade as soon as one is published (the defect is a small bounds check on the MS IMA ADPCM divisor, so upstream fixes are typically quick once acknowledged). Until then, treat the issue as a crash-only denial of service and apply compensating controls: do not open or play attacker-supplied or untrusted Microsoft IMA ADPCM files with any vgmstream-based tool, which is the simplest and most effective mitigation at the cost of losing legitimate playback of that format; if the format must be processed, run the decoder inside an isolated low-privilege subprocess, container or job object with automatic restart so that a SIGFPE terminates only the sandboxed worker and not the host application, accepting the operational overhead of process isolation; and where the embedding application builds vgmstream itself, consider disabling the MS IMA ADPCM decoder at compile time or filtering such inputs before they reach the library, with the trade-off that legitimate MS IMA audio will no longer decode and may need a separate trusted converter. Monitor VULDB references https://vuldb.com/vuln/413457, https://vuldb.com/vuln/413457/cti and https://vuldb.com/cve/CVE-2026-105250 for updated patch status; note that because this is an availability-only defect with a user-interaction prerequisite, it should not displace higher-severity memory-corruption work in remediation queues.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
vgmstream is a widely embedded audio-decoding library used by game-audio players, converters and tooling to play streamed console/game formats. The vulnerable path is the Microsoft IMA ADPCM decoder, implemented in src/coding/ima_decoder.c in the function decode_ms_ima. This is a classic CWE-369 (Divide By Zero) condition: when the malformed input drives a value that the code uses as a divisor - typically a block/frame size, sample-count or channel-stride derived from the file header - down to zero, the arithmetic operation traps and the process is terminated by a SIGFPE on most platforms. Because the fault occurs during header/block parsing of one specific codec path, only MS IMA ADPCM input reaches it; other codecs and well-formed files are unaffected. The vulnerability is scored 5.3 under CVSS 4.0 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L) by the CNA, while independent assessment maps it to CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - both agree that the sole consequence is a low-impact availability loss with no confidentiality or integrity component and no server-side or unattended trigger.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Crafted file delivered over network but requires the user to open it (UI:R), no auth needed (PR:N); only a crash results, so C:N/I:N/A:L.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A security vulnerability has been detected in vgmstream up to r2117. Affected is the function decode_ms_ima of the file src/coding/ima_decoder.c of the component Microsoft IMA Decoder. Such manipulation leads to divide by zero. The attack can be executed remotely.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB