Libvgm
Monthly
Heap out-of-bounds read in the PCM data-block decompressor (DecompressDataBlk) of ValleyBell libvgm through commit a6eed945 allows a crafted .vgm file to crash the consuming application. A malicious file supplies a PCM data block of type 0x7F with an undersized compression table that is then indexed by wider compressed values, forcing an out-of-bounds heap read; the confirmed impact is a denial-of-service crash of whatever player, converter, or emulator embeds the library, with no code execution, privilege escalation, or confirmed data disclosure. Publicly available proof-of-concept exploit code exists, and the issue is being tracked by VulnCheck; no confirmed active exploitation (CISA KEV) has been reported. Exploitation is local and file-based (CVSS:3.1/AV:L/AC:L/PR:N/UI:R), so an attacker must convince a victim to open the malicious media file, and no public EPSS score was included in the available data.
Heap out-of-bounds read in the PCM data-block decompressor (DecompressDataBlk) of ValleyBell libvgm through commit a6eed945 allows a crafted .vgm file to crash the consuming application. A malicious file supplies a PCM data block of type 0x7F with an undersized compression table that is then indexed by wider compressed values, forcing an out-of-bounds heap read; the confirmed impact is a denial-of-service crash of whatever player, converter, or emulator embeds the library, with no code execution, privilege escalation, or confirmed data disclosure. Publicly available proof-of-concept exploit code exists, and the issue is being tracked by VulnCheck; no confirmed active exploitation (CISA KEV) has been reported. Exploitation is local and file-based (CVSS:3.1/AV:L/AC:L/PR:N/UI:R), so an attacker must convince a victim to open the malicious media file, and no public EPSS score was included in the available data.