EUVD-2026-81677
GHSA-4fcx-9cr4-72mc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
A desktop audio library only decodes a file the user chooses to open, so AV:L and UI:R; low, unproven-escalation memory corruption gives C/I/A:L with no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A weakness has been identified in vgmstream up to r2117. Impacted is the function vadpcm_read_coefs_be of the file src/coding/vadpcm_decoder.c of the component EA SCHl parser. This manipulation of the argument entry/entries causes out-of-bounds write. Remote exploitation of the attack is possible. Patch name: ae37662ad626254ddd96ad69ac263792d7a92024. It is suggested to install a patch to address this issue.
AnalysisAI
Out-of-bounds write in vgmstream (through r2117) lets an attacker corrupt heap memory when a crafted EA SCHl audio file is decoded, triggered inside vadpcm_read_coefs_be in src/coding/vadpcm_decoder.c via a manipulated coefficient entry/entries count. The vulnerable code path is reached from any application embedding the library - media players and game-audio converters that use vgmstream - but exploitation requires the victim to open or load the malicious file (passive user interaction); there is no network service to hit and no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to open or load an attacker-crafted EA SCHl-format audio file in an application that embeds vgmstream (r2117 or earlier); the manipulated field is the VADPCM coefficient entry/entries count parsed by vadpcm_read_coefs_be in the EA SCHl parser. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a memory-corruption (CWE-787 out-of-bounds write) bug in vgmstream's EA SCHl parser (vadpcm_read_coefs_be in src/coding/vadpcm_decoder.c), reported by VulDB with a vendor CVSS 4.0 base score of 5.3 (AV:N/AC:L/AT:N/PR:N/UI:P - network-reachable but requiring passive user interaction, all impacts Low). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Build vgmstream from source at or after commit ae37662ad626254ddd96ad69ac263792d7a92024 (PR https://github.com/vgmstream/vgmstream/pull/2008), which adds input validation around decoding setup and bounds the VADPCM coefficient handling; no tagged release version containing the fix is confirmed in the available data, so downstream integrators should pin the commit or the next release rather than assume r2117 is safe. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Resource exhaustion in vgmstream up to revision r2117 allows a remote attacker to trigger application unresponsiveness o
Stack-based buffer overflow in vgmstream up to r2117 allows a remote attacker to crash or potentially execute arbitrary
A divide-by-zero in vgmstream's AWB parser (init_vgmstream_awb_memory in src/meta/awb.c) lets a malformed Atom Wave Bank
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today