Vocaloid6 Editor
Monthly
VOCALOID6 Editor fails to disable XML external entity resolution when it parses project files, so a crafted project can cause unintended outbound communication, disclosure of files readable by the editor process, or a denial-of-service crash. The issue is rated CVSS 7.1 and requires local file loading plus user interaction (AV:L/UI:R, PR:N), which limits practical exploitation to social-engineering delivery of a malicious project file. No public exploit code or active exploitation was identified in the provided intelligence, making this a genuine but not emergency-priority risk.
VOCALOID6 Editor fails to disable XML external entity resolution when it parses project files, so a crafted project can cause unintended outbound communication, disclosure of files readable by the editor process, or a denial-of-service crash. The issue is rated CVSS 7.1 and requires local file loading plus user interaction (AV:L/UI:R, PR:N), which limits practical exploitation to social-engineering delivery of a malicious project file. No public exploit code or active exploitation was identified in the provided intelligence, making this a genuine but not emergency-priority risk.