vgmstream EUVD-2026-92274

Requires the victim to open or load a specially crafted TXTP playlist file (or related TXTH/VAB config/name-table file) into a vgmstream-based player or plugin; the trigger is an over-length key/value/command token that overflows a fixed-size stack buffer because the sscanf '%[^...]' scans lacked field-width limits (fixed in the patch by adding TXT_LINE_KEY_STR/TXT_LINE_VAL_STR/TXT_PATH_LIMIT caps). Exploitation is limited by the required user interaction (UI:P - the malicious file must be deliberately loaded), the client-side file-parsing nature of the flaw (no listening service), and applies only to vgmstream builds up to r2117 before the patched commit.

This is a low-to-moderate priority issue despite a CWE-787 out-of-bounds write classification. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L) scores 5.3 (Medium) and is internally consistent: network-reachable but requiring passive user interaction (UI:P), with only Low impact on confidentiality, integrity, and availability - appropriate for a memory-corruption bug in a client-side media parser rather than a server. No EPSS score, KEV listing, or public POC was provided; exploitation status is therefore 'no public exploit identified at time of analysis', and there is no evidence of active exploitation. The AV:N rating reflects that a malicious file can be delivered over a network, but exploitation is fundamentally client-side and file-driven (the user must load a crafted TXTP/TXTH file into a vgmstream-based player), which sharply limits scalability versus a true remote-unauthenticated service flaw. The root cause confirmed in the patch is unbounded sscanf '%[...]' format specifiers writing into fixed-size stack buffers; while CWE-787 stack overflows can sometimes escalate to code execution, the vendor/VulDB-assigned Low impact metrics suggest the practical outcome is more likely corruption or crash. Net: a legitimate bug worth patching, but not an emergency - more a defense-in-depth fix than an exposed-service priority.

An attacker crafts a malicious TXTP (or related TXTH/name-table) file containing an overly long key or value token and distributes it (e.g., bundled with a game-music rip or shared download). When a victim opens the file in a vgmstream-based player or plugin, the unbounded sscanf parse in txtp_parser.c writes past a fixed stack buffer, corrupting memory and potentially crashing or executing attacker-influenced data. No public exploit code was identified in the provided intelligence.