CVE-2026-111150 in libvgm
Summary
by MITRE • 10/15/2026
ValleyBell libvgm through commit a6eed945 contains a heap out-of-bounds read vulnerability in the PCM data-block decompressor caused by an unbounded compression-table index. Attackers can supply a crafted .vgm file with a small type 0x7F table and wider compressed values, causing DecompressDataBlk to over-read heap memory and crash consumers.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in ValleyBell libvgm represents a critical security flaw within the library's PCM data-block decompression logic, specifically triggered by an unbounded compression-table index during the processing of .vgm files. This issue stems from insufficient validation of input parameters when handling type 0x7F tables, which are used to define specific audio playback behaviors in VGM (Video Game Music) file formats. The core technical failure lies in the DecompressDataBlk function, which fails to ensure that indices derived from compressed data remain within the allocated bounds of the compression table. When an attacker supplies a crafted .vgm file containing a small type 0x7F table paired with wider-than-expected compressed values, the decompressor attempts to access memory locations beyond the end of the heap-allocated buffer. This results in a heap out-of-bounds read, allowing the application to retrieve unintended data from adjacent memory regions or causing an immediate crash due to invalid memory access violations.
From a technical perspective, this vulnerability aligns with CWE-125, which describes Out-of-Bounds Read vulnerabilities where software reads past the end of a buffer. The exploitation vector relies on the parser's inability to correctly map compressed indices to valid table entries before performing memory accesses. In typical VGM playback scenarios, these files are often processed by media players or emulators that may not implement strict sandboxing for audio decoding routines. Consequently, an attacker can craft malicious .vgm files designed to trigger this out-of-bounds read when opened or played by a vulnerable application. The immediate operational impact is typically a denial of service through application crashes, as the operating system terminates processes attempting illegal memory accesses. However, depending on the specific architecture and compiler optimizations, such reads could potentially leak sensitive information from adjacent heap allocations if the process does not terminate immediately upon detection of the invalid access.
The security implications extend beyond simple stability issues, touching upon broader categories defined by industry standards. This flaw is categorized under CWE-20, Improper Input Validation, as the root cause is the failure to sanitize and validate user-supplied data before processing it within critical decompression routines. Furthermore, in the context of the MITRE ATT&CK framework, this vulnerability facilitates Initial Execution through crafted media files, which can serve as a delivery mechanism for further attacks if combined with other exploitation techniques such as information disclosure or code execution via subsequent memory corruption bugs triggered by the leaked data. The lack of bounds checking on table indices is a common pitfall in audio processing libraries that prioritize performance over rigorous input validation, making it essential to address this gap to prevent potential security breaches.
To mitigate this vulnerability, developers must implement strict boundary checks within the DecompressDataBlk function and related parsing logic. It is imperative to validate all compression-table indices against the actual size of the allocated table before any memory read operation occurs. Input validation should ensure that compressed values do not exceed the maximum valid index for their respective table types, particularly for type 0x7F entries which have specific structural requirements. Additionally, integrating fuzzing tests into the development pipeline can help identify similar edge cases in other decompression routines. Updating to a patched version of libvgm is the primary remediation strategy, as it ensures that these bounds checks are enforced consistently across all supported VGM features. Security-conscious consumers should also consider using audio players or libraries that incorporate additional sandboxing measures for untrusted media files to limit the impact of any potential memory access violations.