EUVD-2026-81616
GHSA-8r6v-wgrg-22rc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Malicious file can be delivered remotely (AV:N) but must be opened by the user (UI:R); no privileges needed (PR:N); impact is a limited local process DoS only (A:L, C:N/I:N).
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A security flaw has been discovered in vgmstream up to r2117. This issue affects the function parse_mus of the file src/meta/mus_acm.c. The manipulation results in resource consumption. The attack may be launched remotely. The patch is identified as ae37662ad626254ddd96ad69ac263792d7a92024. Applying a patch is advised to resolve this issue.
AnalysisAI
Resource exhaustion in the vgmstream audio-decoding library (builds up to and including r2117) lets a crafted .mus (ACM) file drive unbounded memory or CPU consumption through the parse_mus routine in src/meta/mus_acm.c. An attacker must convince a victim to open or load the malicious audio file in any application, plugin, or converter built on vgmstream, since the parser only runs on user-supplied input and is not reachable through an unattended network service. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a victim to open or load an attacker-supplied crafted .mus (ACM) audio file in an application or plugin built on vgmstream (r2117 or earlier); the malformed file declares an out-of-range file_count that parse_mus fails to bound. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a low-priority, availability-only issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream fix by updating vgmstream to a build that includes commit ae37662ad626254ddd96ad69ac263792d7a92024 (merged via PR 2008), which bounds the parsed segment count to MAX_ACM_SEGMENTS=128 and rejects out-of-range values; note that a released, tagged version containing this commit is not independently confirmed in the supplied data, so verify the commit is present in the build you deploy or rebuild downstream applications and plugins against the patched source (https://github.com/vgmstream/vgmstream/commit/ae37662ad626254ddd96ad69ac263792d7a92024, https://github.com/vgmstream/vgmstream/pull/2008). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today