Vocaloid6
Monthly
Local named-pipe privilege escalation in Yamaha VOCALOID6 exposes privileged Editor functions to any co-resident process running under the same local user account, requiring no additional authentication. The flaw (CWE-306, Missing Authentication for Critical Function) stems from the VOCALOID6 Editor's local named pipe lacking access controls, allowing a low-privileged process owned by the same OS user to communicate with it directly. No public exploit or CISA KEV listing is identified at time of analysis; the EPSS signal is unavailable, but the CVSS score of 3.3 and local-only attack vector constrain real-world impact to same-account, same-machine scenarios.
Hard-coded credentials embedded in VOCALOID6 by Yamaha Corporation allow an attacker to impersonate a legitimate VOCALOID6 Editor client and authenticate to Yamaha's backend activation and content delivery servers. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector indicates this is network-exploitable without authentication or user interaction, as the credentials are distributed within publicly available client software. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the advisory was coordinated through JPCERT/CC (JVNVU90210212).
Local named-pipe privilege escalation in Yamaha VOCALOID6 exposes privileged Editor functions to any co-resident process running under the same local user account, requiring no additional authentication. The flaw (CWE-306, Missing Authentication for Critical Function) stems from the VOCALOID6 Editor's local named pipe lacking access controls, allowing a low-privileged process owned by the same OS user to communicate with it directly. No public exploit or CISA KEV listing is identified at time of analysis; the EPSS signal is unavailable, but the CVSS score of 3.3 and local-only attack vector constrain real-world impact to same-account, same-machine scenarios.
Hard-coded credentials embedded in VOCALOID6 by Yamaha Corporation allow an attacker to impersonate a legitimate VOCALOID6 Editor client and authenticate to Yamaha's backend activation and content delivery servers. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector indicates this is network-exploitable without authentication or user interaction, as the credentials are distributed within publicly available client software. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the advisory was coordinated through JPCERT/CC (JVNVU90210212).