EUVD-2026-92276
GHSA-c5vv-42x3-j64w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious TXTP file
-
DeliveryDeliver to local user
-
ExploitTrigger use-after-free in make_group_random
-
ExecutionCorrupt freed VGMSTREAM object
-
ImpactCrash process (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to locally open or process an attacker-crafted TXTP file (the vgmstream TXTP File Handler) in an application that embeds vgmstream at or below revision r2117; the flaw is in make_group_random, so a TXTP using a random group definition is specifically needed to reach the vulnerable code path. Limiting factors: the attack is local only (AV:L), requires user interaction to open the malicious file (UI:P), the vendor vector lists PR:L implying some local privilege, and impact is limited (VC/VI/VA:L) - most plausibly a crash/DoS rather than code execution. Not reachable by a remote unauthenticated attacker. |
| Impact | All available signals point to a genuinely low-priority, low-real-risk issue. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:P) yields a base score of only 2.4, reflecting a local attack vector with required user interaction and only Low confidentiality/integrity/availability impact. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the provided data - so this is neither confirmed exploited nor demonstrably trivial to weaponize. The source-code evidence confirms the vulnerability class is a use-after-free (the patch removes a stale pointer usage and a close_vgmstream() call in make_group_random), which contradicts the CWE-119 label (generic buffer error) and the 'Buffer Overflow' tag; the realistic impact for a local media-parsing library is a crash/denial of service rather than reliable remote code execution. One notable conflict: the vendor vector specifies PR:L (some privilege required) and UI:P, yet the vulnerability is triggered simply by processing an attacker-crafted TXTP file in a media player - a scenario that typically needs no prior privilege, so the PR:L choice should be verified with the vendor. Net assessment: not a priority outside of the specific game-audio tooling that embeds vgmstream. |
| Exploit ScenarioDerived | An attacker crafts a malicious TXTP playlist/config file that abuses the random-group handling in vgmstream's TXTP parser and distributes it alongside game-audio rips or via a shared file. When a local user opens the file in an application that embeds vgmstream (e.g., a foobar2000/Audacious/VLC-style plugin), the make_group_random code dereferences a freed VGMSTREAM object, causing a use-after-free that most likely crashes the process (denial of service). No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Use-after-free in the TXTP file handler of vgmstream (the open-source video-game audio decoding library) affects builds up to and including revision r2117, specifically the make_group_random function in src/meta/txtp_process.c. The flaw is triggered when a locally processed TXTP playlist file uses a random group definition, causing a stale VGMSTREAM pointer to be dereferenced after the group structure is rebuilt; the vendor rates it CVSS 4.0 2.4 (AV:L/PR:L/UI:P), and the independent assessment agrees on local-only, user-interaction-gated reachability with limited impact (C:L/I:L/A:L), making a crash/denial-of-service the most plausible outcome rather than code execution. There is no CISA KEV entry and no public exploit identified at time of analysis. An upstream fix exists as commit ae37662ad626254ddd96ad69ac263792d7a92024.
RemediationAI
Apply the upstream fix commit ae37662ad626254ddd96ad69ac263792d7a92024 (referenced from https://github.com/vgmstream/vgmstream/pull/2008, resolving issue 1998) or upgrade to a vgmstream build newer than r2117 that contains it; because the fix landed as a Git commit rather than a tagged release, the exact patched release version cannot be confirmed from the available data, so integrators should verify that the fix hash is present in their vendored copy. Until patched, the practical compensating control is input hygiene: do not open TXTP files from untrusted sources, and in any application that embeds vgmstream, gate file-opening behind explicit user confirmation and sandbox or run the decode process with least privilege; note the trade-off that this blocks legitimate TXTP playlist functionality entirely. If TXTP support is not required, disable or filter .txtp handling at the embedding application level, and, where the consuming pipeline can inspect file contents, reject TXTP files that declare random groups, which are the specific construct needed to reach make_group_random. Note that the referenced commit also hardens psx_decoder.c, vadpcm_decoder.c, awb.c and mus_acm.c, so applying the full commit is preferable to hand-porting only the txtp_process.c hunk, which could leave the related bounds and division-by-zero issues unfixed. Finally, treat crash reports from TXTP parsing as potential indicators of exploitation attempts and add the affected process to memory-safety monitoring, since the impact observed in testing is expected to be a crash rather than code execution.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
vgmstream is a library (with CLI wrappers such as vgmstream-cli and vgmstream123, and integration into players/front-ends) for decoding proprietary video-game audio formats. TXTP is a text-based "playlist/template" meta-format that lets users describe segment, layer, and random groups over underlying streams; processing is implemented in src/meta/txtp_process.c. The affected routine, make_group_random, first captures a pointer to a member stream (vgmstream = txtp->vgmstream[position + selected]) and later, inside the block that may call make_group_segment to restructure the group, continues to operate on that captured pointer. When the group is rebuilt or a segment is synthesised, the underlying stream can be closed or the array reallocated, so the previously cached pointer becomes dangling - a classic use-after-free (memory-safety class reported as CWE-119, improper restriction of operations within the bounds of a memory buffer, in the available metadata; the vendor also tags the issue as buffer overflow/denial of service). The upstream patch scopes the pointer to the block and re-reads txtp->vgmstream[position] before use, and also removes an unconditional close_vgmstream call, eliminating the stale-reference path. The same commit bundles hardening in psx_decoder.c (signed-to-size_t frame accounting), vadpcm_decoder.c (bounds-checking entries/order), awb.c (division-by-zero guards) and mus_acm.c (segment-count cap), indicating a general robustness sweep of the TXTP/audio-parsing code rather than an isolated single-line fix.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Triggered by opening an attacker-supplied TXTP file in a local player, so AV:L and UI:R with PR:N (no prior privilege needed); use-after-free yields only limited C/I/A impact.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A weakness has been identified in vgmstream up to r2117. This impacts the function make_group_random of the file src/meta/txtp_process.c of the component TXTP File Handler. This manipulation causes use after free. The attack needs to be launched locally. Patch name: ae37662ad626254ddd96ad69ac263792d7a92024. It is recommended to apply a patch to fix this issue.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB