CVE-2026-105251 in vgmstream
Summary
by MITRE • 10/05/2026
A vulnerability was detected in vgmstream up to r2117. Affected by this vulnerability is the function ps_find_padding of the file src/coding/psx_decoder.c of the component VAG File Handler. Performing a manipulation results in out-of-bounds read. The attack is possible to be carried out remotely. The patch is named 4b8316652a30d40f99ad43310bed273fd1f8a7a3. It is suggested to install a patch to address this issue.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/05/2026
The vulnerability identified in vgmstream prior to revision r2117 represents a critical memory safety flaw located within the VAG File Handler component, specifically affecting the ps_find_padding function found in the source file src/coding/psx_decoder.c. This software is widely utilized for decoding and playing back audio formats associated with video game consoles, particularly those utilizing Sony PlayStation sound hardware. The core technical issue stems from an improper boundary check during the parsing of VAG (Voice Audio Group) files, which are commonly used in PS1 and PS2 games to store compressed audio data. When processing these files, the decoder attempts to locate padding bytes that may be present for alignment or structural purposes within the file format. However, due to insufficient validation of input parameters and file structure integrity, the function fails to verify whether the calculated offset for reading this padding remains within the allocated memory buffer boundaries.
This logic error results in an out-of-bounds read operation, which is formally classified under CWE-125: Out-of-bounds Read. In practical terms, when a maliciously crafted VAG file containing malformed or truncated data headers is processed by vgmstream, the application attempts to access memory locations that lie beyond the end of the valid buffer region. This behavior violates fundamental principles of secure coding and memory management, leading to undefined behavior within the executing process. The severity of this vulnerability lies in its potential for remote exploitation, as attackers can distribute specially constructed audio files through various vectors such as email attachments, malicious websites hosting game assets, or compromised software repositories. Upon execution by a victim using an unpatched version of vgmstream, the out-of-bounds read may lead to information disclosure, where sensitive data residing in adjacent memory regions is leaked into the application's output stream or error logs.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1059: Command and Scripting Interpreter if exploited for further code execution via subsequent vulnerabilities, although primarily it falls under initial access vectors involving malicious files. The ability to perform remote exploitation means that an attacker does not need physical or local system access to trigger the flaw; instead, they can rely on social engineering or automated distribution mechanisms to deliver the payload. While out-of-bounds reads are often considered less severe than buffer overflows because they do not directly allow arbitrary code execution without additional conditions, they serve as a significant stepping stone in attack chains. They can be used for fingerprinting operating system memory layouts, bypassing security mitigations like ASLR by leaking pointer addresses, or triggering crashes that facilitate denial-of-service attacks against services relying on vgmstream for audio processing.
The operational impact of this vulnerability extends beyond simple data leakage. In environments where vgmstream is integrated into larger applications such as media players, game modding tools, or automated testing frameworks, a crash caused by accessing invalid memory can lead to service disruption. For standalone users, the primary risk remains privacy violation through information disclosure and potential instability in host systems if the leaked data contains cryptographic keys or session tokens from other running processes sharing similar memory pages. Furthermore, because vgmstream is often used as a library within other software projects, this vulnerability could propagate risks downstream to applications that depend on it for audio decoding capabilities without their own additional validation layers.
To mitigate these risks, immediate action is required by updating the vgmstream installation to version r2117 or later, which incorporates the patch identified by commit hash 4b8316652a30d40f99ad43310bed273fd1f8a7a3. This update introduces rigorous boundary checks within the ps_find_padding function to ensure that any read operations remain strictly within the bounds of the allocated buffer derived from the input file size and header information. Organizations should also implement strict input validation policies for all audio files processed by their systems, treating external media assets as untrusted sources until verified. Additionally, deploying runtime application self-protection mechanisms or memory safety tools can help detect and block exploitation attempts in real-time. Regular security audits of codebases utilizing vgmstream are recommended to ensure that no other similar vulnerabilities exist within the decoding pipeline, particularly those related to integer overflows or improper type conversions during file parsing operations.