CVE-2026-105250 in vgmstream
Summary
by MITRE • 10/05/2026
A security vulnerability has been detected in vgmstream up to r2117. Affected is the function decode_ms_ima of the file src/coding/ima_decoder.c of the component Microsoft IMA Decoder. Such manipulation leads to divide by zero. The attack can be executed remotely.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/05/2026
The vulnerability identified in vgmstream, specifically affecting versions up to revision r2117 within the Microsoft IMA ADPCM decoder module, represents a critical arithmetic error that compromises the stability and availability of audio processing applications. This flaw resides in the decode_ms_ima function located in src/coding/ima_decoder.c, where improper validation of input parameters allows for mathematical operations under invalid conditions. The core technical issue is a divide-by-zero exception triggered when specific malformed or crafted audio data files are processed by the decoder. In C-based software, such arithmetic errors typically result in undefined behavior, which on most modern operating systems manifests as an immediate application crash due to unhandled exceptions. This type of vulnerability falls squarely under CWE-369, known as Divide By Zero, a category of defects where a division operation is performed with a divisor that evaluates to zero, leading to system instability or denial of service conditions rather than direct code execution in this specific context.
From an operational perspective, the impact of this vulnerability is primarily centered on availability and reliability for users who rely on vgmstream for audio playback, conversion, or analysis tasks involving Microsoft IMA ADPCM encoded files. Since the attack vector allows remote execution, a threat actor could distribute maliciously crafted audio files through various channels such as email attachments, compromised websites, or file-sharing platforms. When an unsuspecting user opens or processes one of these specially constructed files using a vulnerable version of vgmstream, the application will likely terminate abruptly without warning. This denial of service effect disrupts workflow and can lead to data loss if unsaved work is involved. While the primary impact is stability-related, in complex software ecosystems where audio decoders are embedded within larger applications like game engines or media players, such crashes could potentially be leveraged for further exploitation if other memory corruption vulnerabilities exist nearby, although the immediate threat remains a reliable crash mechanism.
The presence of this flaw highlights the importance of rigorous input validation and defensive programming practices in multimedia libraries that handle untrusted data sources. The Microsoft IMA ADPCM format is widely used in video games and older media formats, making vgmstream a common tool for developers and enthusiasts alike. Consequently, the attack surface is significant due to the widespread adoption of these tools across different platforms including Windows, macOS, and Linux environments. To mitigate this risk, users should immediately upgrade to versions of vgmstream released after r2117 where the divide-by-zero condition has been addressed through proper checks on divisor values before performing arithmetic operations. Developers integrating vgmstream into their own projects must ensure they are linking against patched library versions or implementing additional sanity checks around audio file inputs. Furthermore, adopting static analysis tools and fuzzing techniques during development can help identify similar arithmetic vulnerabilities early in the lifecycle, reducing exposure to such common yet impactful defects classified under CWE-369 and aligning with ATT&CK tactics related to resource hijacking via denial of service mechanisms.