CVE-2026-86514 in vgmstream
Summary
by MITRE • 09/08/2026
A weakness has been identified in vgmstream up to r2117. This issue affects the function sscanf of the file src/meta/txth.c of the component txth-txtp. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Patch name: 4669d37a6af94866f6f0628678f9f90d46954e8b. To fix this issue, it is recommended to deploy a patch.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified in vgmstream prior to revision r2117 represents a critical security flaw located within the txth-txtp component, specifically affecting the source file src/meta/txth.c. This software library is widely used for decoding various video game audio formats, and its widespread adoption makes any weakness therein particularly significant from a defensive standpoint. The core of the issue lies in the improper handling of input data during the parsing process, which leads to a stack-based buffer overflow. Such vulnerabilities are among the most dangerous types because they allow an attacker to overwrite adjacent memory on the call stack, potentially gaining control over the program's execution flow or executing arbitrary code with the privileges of the affected application.
The technical root cause is attributed to the misuse of the sscanf function within the txth.c module. In C programming, functions like sscanf are prone to buffer overflow errors if they do not strictly enforce length limits on the destination buffers where parsed data is stored. When processing malformed or specifically crafted input files that adhere to the TXTH/TXTP format specifications but contain oversized fields, the library fails to validate the size of the incoming string against the allocated stack space. This lack of bounds checking results in writing more bytes than the buffer can hold, corrupting the stack frame and potentially overwriting critical return addresses or function pointers stored on the stack.
From an operational perspective, this vulnerability is remotely exploitable, meaning that a threat actor does not need physical access to the target system or prior authentication to trigger the flaw. An attacker could distribute a maliciously crafted audio file containing the exploit payload through various vectors such as email attachments, compromised websites hosting game assets, or peer-to-peer networks. Once a user opens this file using an affected version of vgmstream, the buffer overflow is triggered during the parsing phase. Given that public exploits have been released for this issue, the risk level is elevated significantly as automated attack tools can be deployed to target vulnerable instances without requiring custom development by the attacker.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-120, which describes Buffer Copy without Checking Size of Input. Furthermore, in the context of the MITRE ATT&CK framework, this flaw facilitates techniques associated with Initial Execution and potentially Privilege Escalation if the application runs with elevated permissions. The ability to execute arbitrary code remotely places it within the scope of high-severity vulnerabilities that require immediate attention from security operations teams.
To mitigate this risk, organizations relying on vgmstream must ensure they upgrade to version r2117 or later immediately. The provided patch commit 4669d37a6af94866f6f0628678f9f90d46954e8b addresses the specific buffer handling logic in src/meta/txth.c by implementing proper input validation and size checks before copying data into stack buffers. In addition to patching, defensive measures should include deploying intrusion detection systems configured to detect patterns associated with this specific exploit signature if possible, and restricting file execution policies for untrusted users or services that process audio files from external sources. Regular auditing of third-party dependencies is also recommended to prevent similar issues in other components of the software stack.