| عنوان | vgmstream r2117 Use After Free |
|---|
| الوصف | vgmstream contains a CWE-416 vulnerability in make_group_random() in src/meta/txtp_process.c. The function can move the selected stream into the shared list with update_vgmstream_list(), then call make_group_segment() on that stream. If segment creation fails, the selected object may already have been freed by the callee, but the caller still reaches the shared fail path and closes the stale local pointer again. A crafted TXTP file can therefore trigger a use-after-free during random-group failure cleanup, causing process termination and potentially enabling further memory corruption.
I re-verified this issue against the latest upstream HEAD commit 79bc65b52cddc61b859679c1c47dc57092872ae1 on 2026-08-21 and confirmed that the vulnerable logic is still present there.
Affected component / root cause: txtp:random-group-failed-segment-transfer-double-closes-selected-stream
CWE: CWE-416
CVSS v3.1 draft: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
|---|
| المصدر | ⚠️ https://github.com/vgmstream/vgmstream/issues/1998 |
|---|
| المستخدم | ni-liao (UID 98297) |
|---|
| ارسال | 13/09/2026 04:31 PM (22 أيام منذ) |
|---|
| الاعتدال | 04/10/2026 07:37 PM (21 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 413456 [vgmstream حتى r2117 TXTP File src/meta/txtp_process.c make_group_random تلف الذاكرة] |
|---|
| النقاط | 20 |
|---|