CVE-2026-105249

Katalog CVE

CVSS 4.8 · Medium EPSS 0,11%

Kerentanan Improper Restriction of Operations within the Bounds of a Memory Buffer. Skor CVSS 3.1 4.8 (Medium) menurut vuldb.com.

Deskripsi (NVD)

A weakness has been identified in vgmstream up to r2117. This impacts the function make_group_random of the file src/meta/txtp_process.c of the component TXTP File Handler. This manipulation causes use after free. The attack needs to be launched locally. Patch name: ae37662ad626254ddd96ad69ac263792d7a92024. It is recommended to apply a patch to fix this issue.

Rincian

Terbit di NVD

5 Oktober 2026

Terakhir diubah

7 Oktober 2026

Status NVD

Deferred

CVSS 3.1

4.8 (Medium), sumber vuldb.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-416: Use After Free

EPSS (30 hari)

0,11% peluang dieksploitasi; lebih tinggi dari 1,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/vgmstream/vgmstream/
• https://github.com/vgmstream/vgmstream/commit/ae37662ad626254ddd96ad69ac263792d7a92024
• https://github.com/vgmstream/vgmstream/issues/1998
• https://github.com/vgmstream/vgmstream/pull/2008
• https://vuldb.com/cve/CVE-2026-105249
• https://vuldb.com/submit/976279
• https://vuldb.com/vuln/413456
• https://vuldb.com/vuln/413456/cti