libvgm CVE-2026-111150

Exploitation requires a victim to open or process an attacker-supplied .vgm file in an application that uses libvgm; the file must contain a PCM data block of type 0x7F whose compression table is undersized while referencing wider compressed values, causing DecompressDataBlk to index beyond the table bounds. Limiting factors that reduce real-world risk: exploitation is local and file-based (AV:L) rather than remote, it requires user interaction (the victim must open the crafted file), and the demonstrated impact is limited to a crash/denial-of-service of the consumer - no code execution, privilege escalation, or confirmed confidentiality impact. There is no authentication requirement (PR:N), but the attacker cannot trigger the flaw without the victim choosing to process the malicious media file.

This is a memory-safety defect (CWE-125 heap out-of-bounds read) in libvgm's PCM data-block decompressor, confirmed by VulnCheck with publicly available proof-of-concept exploit code. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) tells a consistent story of a low-severity, availability-only issue: exploitation is local/file-based, requires passive user interaction (opening a crafted .vgm file), needs no privileges, and produces only a crash (VA:H) with no confidentiality or integrity impact. The score of 6.8 is MEDIUM, and the real-world risk is lower still because the only demonstrated outcome is a denial-of-service crash of the consuming application, not code execution or data theft. There is NO CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation - the risk is driven solely by POC availability, not observed attacks. Note a conflict worth flagging: the input Tags include 'Information Disclosure', but the authoritative CVSS confidentiality metric is VC:N, meaning no confidentiality impact is scored; although an OOB read can in principle leak adjacent heap bytes, the vendor-provided vector and description frame this strictly as an over-read that crashes consumers, so treat 'information disclosure' as unconfirmed. Overall this is a genuine but low-priority bug best handled through routine patching rather than emergency response.

An attacker crafts a malicious .vgm music file containing a type 0x7F PCM compression table that is deliberately undersized relative to the width of the compressed values it references. When a victim opens or plays this file in any application built on libvgm, DecompressDataBlk indexes past the end of the compression table and over-reads heap memory, crashing the consuming program. A public proof-of-concept exists (documented by VulnCheck and a HackMD writeup), so reliable triggering of the crash is already within reach of unsophisticated attackers.