Vgmstream
Monthly
Resource exhaustion in vgmstream up to revision r2117 allows a remote attacker to trigger application unresponsiveness or crash by supplying a crafted TXTP playlist file containing adversarial range_start/range_end values to the add_entry parser function in src/meta/txtp_parser.c. A public proof-of-concept exists (GitHub issue #1973) and an upstream patch has been merged (commit 4b6a02dd1aff6428255db912563d77d4cb0a143e). The CVSS 4.0 score of 2.1 and low availability impact rating reflect that no public exploit indicates active exploitation, user interaction is required, and there is no confidentiality or integrity impact.
Stack-based buffer overflow in vgmstream up to r2117 allows a remote attacker to crash or potentially execute arbitrary code by delivering a specially crafted TXTH or TXTP audio metadata file to a user. The root cause is an unbounded sscanf invocation in src/meta/txth.c that writes attacker-controlled content from a text metadata file into a fixed-size stack buffer without field-width constraints (CWE-121). Publicly available exploit code exists (GitHub issue #1972), and an upstream patch commit is available (4669d37a6af94866f6f0628678f9f90d46954e8b via PR #1956), though no formally tagged patched release has been independently confirmed.
Resource exhaustion in vgmstream up to revision r2117 allows a remote attacker to trigger application unresponsiveness or crash by supplying a crafted TXTP playlist file containing adversarial range_start/range_end values to the add_entry parser function in src/meta/txtp_parser.c. A public proof-of-concept exists (GitHub issue #1973) and an upstream patch has been merged (commit 4b6a02dd1aff6428255db912563d77d4cb0a143e). The CVSS 4.0 score of 2.1 and low availability impact rating reflect that no public exploit indicates active exploitation, user interaction is required, and there is no confidentiality or integrity impact.
Stack-based buffer overflow in vgmstream up to r2117 allows a remote attacker to crash or potentially execute arbitrary code by delivering a specially crafted TXTH or TXTP audio metadata file to a user. The root cause is an unbounded sscanf invocation in src/meta/txth.c that writes attacker-controlled content from a text metadata file into a fixed-size stack buffer without field-width constraints (CWE-121). Publicly available exploit code exists (GitHub issue #1972), and an upstream patch commit is available (4669d37a6af94866f6f0628678f9f90d46954e8b via PR #1956), though no formally tagged patched release has been independently confirmed.