CVE-2026-110660 in vgmstream
Summary
by MITRE • 10/14/2026
vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the G.722.1/Siren14 decoder in g7221_lib.c, whose bit reader refills without checking the data_u32 array end. Attackers can supply crafted .s14 or .sss files that drive decode_vector_quantized_mlt_indices() past the stack buffer during format detection, crashing the application.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in vgmstream prior to version r2117 represents a critical memory safety issue within its audio decoding subsystem, specifically affecting the G.722.1 and Siren14 codec implementations located in the g7221_lib.c source file. This flaw is classified as an out-of-bounds read vulnerability where the application attempts to access memory locations beyond the allocated boundaries of a stack-allocated buffer. The root cause lies in the bit reader logic used for parsing audio data, which performs refills from the input stream without adequately verifying that the underlying data_u32 array has not been exhausted or exceeded its defined limits. This lack of boundary checking allows the decoder to continue reading past the end of the allocated stack space when processing malformed inputs.
From a technical perspective, the exploitation vector involves supplying specially crafted audio files with extensions such as .s14 or .sss that trigger the decode_vector_quantized_mlt_indices function during the format detection phase. During this initial parsing stage, the decoder attempts to interpret metadata and structural information about the file. Because the bit reader does not validate whether it has reached the end of the available data before attempting to refill its internal buffers, it proceeds to read arbitrary memory contents located immediately after the stack buffer in memory. This behavior constitutes a classic out-of-bounds read condition, which is formally categorized under CWE-125: Out-of-bounds Read in standard vulnerability taxonomies. The specific mechanism of reading uninitialized or adjacent stack data can lead to unpredictable application states depending on what values reside in those neighboring memory locations at the time of execution.
The operational impact of this vulnerability primarily manifests as a denial of service through application crashes. When an attacker provides a maliciously constructed file that triggers this out-of-bounds read, the resulting invalid memory access typically causes the vgmstream process to terminate abruptly via a segmentation fault or similar exception handler invocation. While immediate remote code execution is less likely with a pure read vulnerability compared to write vulnerabilities, the crash itself disrupts any service relying on audio processing capabilities and can potentially leak sensitive information if the adjacent stack data contains cryptographic keys, session tokens, or other confidential values. This aligns with ATT&CK technique T1059: Command and Scripting Interpreter in contexts where vgmstream is used within larger automation pipelines, as the crash could disrupt automated workflows that depend on consistent audio file analysis.
Mitigation strategies for this vulnerability focus primarily on updating to a patched version of vgmstream released after r2117, which includes corrections to the bit reader logic to enforce strict boundary checks before accessing array elements. For environments where immediate patching is not feasible, defensive measures should include implementing input validation at the entry points of audio file processing pipelines to reject files with suspiciously large or malformed headers that might trigger excessive read operations. Additionally, deploying runtime protection mechanisms such as stack canaries and address space layout randomization can help detect or mitigate the consequences of memory corruption attempts by preventing exploitation even if an out-of-bounds access occurs. Regular auditing of third-party audio libraries for similar boundary checking deficiencies is also recommended to maintain robust security posture in applications that handle untrusted media files.