CVE-2026-105249 in vgmstream
Summary
by MITRE • 10/05/2026
A weakness has been identified in vgmstream up to r2117. This impacts the function make_group_random of the file src/meta/txtp_process.c of the component TXTP File Handler. This manipulation causes use after free. The attack needs to be launched locally. Patch name: ae37662ad626254ddd96ad69ac263792d7a92024. It is recommended to apply a patch to fix this issue.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/05/2026
The vulnerability identified in vgmstream prior to revision r2117 represents a critical memory management flaw within the TXTP File Handler component, specifically affecting the make_group_random function located in src/meta/txtp_process.c. This software is widely utilized for decoding and playing back various video game audio formats, making it a common tool among security researchers, developers, and enthusiasts who require access to proprietary or obscure sound file structures. The core of this vulnerability lies in improper handling of memory allocation and deallocation cycles during the processing of TXTP files, which are text-based configuration files often used to define how raw audio data should be interpreted and played back by vgmstream. When a maliciously crafted TXTP file is processed, the application fails to correctly manage pointers associated with dynamically allocated groups of sound samples or metadata structures.
The technical nature of this flaw is classified as a use-after-free vulnerability, which corresponds directly to CWE-416 in the Common Weakness Enumeration standard. In this specific context, the make_group_random function allocates memory for certain data structures required to process randomization parameters within the audio stream. However, due to a logic error or race condition inherent in the code path leading up to revision r2117, these allocated memory blocks are freed prematurely while pointers referencing them remain active and accessible elsewhere in the application's execution flow. Consequently, when subsequent operations attempt to access this already-deallocated memory region, they interact with invalid addresses that may have been reallocated for other purposes by the operating system or overwritten during garbage collection processes. This discrepancy allows an attacker who controls the input data within the TXTP file to manipulate program control flow or read sensitive information from adjacent memory regions.
From a security operations perspective, this vulnerability poses significant risks depending on how vgmstream is deployed and utilized. While the initial assessment indicates that local access is required for exploitation, meaning an attacker must have some level of interaction with the system where vgmstream runs, such as through file upload mechanisms in web applications or social engineering tactics to trick a user into opening a malicious file, the impact can be severe if exploited successfully. A successful use-after-free exploit typically allows for arbitrary code execution by overwriting function pointers or return addresses on the stack or heap, leading to full system compromise. Alternatively, it may result in denial of service conditions through application crashes caused by segmentation faults when accessing unmapped memory pages. This aligns with ATT&CK technique T1203, which covers exploitation for client-side execution, particularly relevant if vgmstream is integrated into larger multimedia frameworks or web-based audio players that process user-uploaded content without sufficient sanitization.
Mitigation strategies must focus on immediate remediation through software updates and enhanced input validation practices. The primary defense against this vulnerability is to upgrade the vgmstream installation to version r2117 or later, where the patch ae37662ad626254ddd96ad69ac263792d7a92024 has been applied. This update corrects the memory management logic within the make_group_random function to ensure that pointers are nullified after deallocation and that no dangling references persist during subsequent operations. For organizations deploying vgmstream in server-side environments or web applications, it is imperative to implement strict input validation on all TXTP files before they reach the vulnerable parsing functions. This includes verifying file headers, limiting file sizes, and sanitizing content to prevent malformed structures from triggering the flawed code paths. Additionally, employing memory-safe programming practices such as Address Sanitizer during development can help detect similar issues in future updates, reducing the attack surface for potential adversaries seeking to leverage memory corruption vulnerabilities for unauthorized access or system disruption.