CVE-2026-86515 in vgmstream
Summary
by MITRE • 09/08/2026
A security vulnerability has been detected in vgmstream up to r2117. Impacted is the function add_entry of the file src/meta/txtp_parser.c of the component txtp. Such manipulation of the argument range_start/range_end leads to resource consumption. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The name of the patch is 4b6a02dd1aff6428255db912563d77d4cb0a143e. It is advisable to implement a patch to correct this issue.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified in vgmstream, specifically affecting versions up to revision r2117, centers on improper input validation within the txtp parser component. The core technical flaw resides in the add_entry function located in src/meta/txtp_parser.c. This module is responsible for parsing text-based audio format descriptions that define how raw audio data should be interpreted and played back. When processing these definitions, the application fails to adequately validate the range_start and range_end arguments provided by the input file. These parameters typically dictate which segments of an audio stream are active or valid during playback. The lack of rigorous boundary checking allows for the specification of values that fall outside expected operational limits or create logical inconsistencies in memory allocation and processing loops.
This specific flaw leads to excessive resource consumption, a category of vulnerability often associated with Denial of Service scenarios. By supplying crafted range_start and range_end values, an attacker can force the application into inefficient computational states or infinite loops during the parsing phase. Instead of gracefully rejecting invalid inputs, the parser may attempt to process non-existent data ranges or allocate disproportionate amounts of memory relative to the actual file size. This behavior results in significant CPU usage spikes and potential memory exhaustion, effectively rendering the vgmstream instance unresponsive or causing it to crash entirely. The impact is particularly severe because it degrades system stability without requiring code execution privileges, making it a straightforward vector for disrupting service availability.
The operational impact of this vulnerability extends beyond simple application crashes. Since vgmstream is often used in automated pipelines, game development tools, and media players that handle untrusted audio assets, an attacker can exploit this flaw remotely by providing maliciously crafted txtp files through network services or file upload mechanisms. The fact that the exploit has been publicly disclosed means that defensive measures must be implemented immediately to prevent exploitation by threat actors who may automate attacks against systems running vulnerable versions of vgmstream. The absence of proper input sanitization transforms a standard media parsing function into an attack surface capable of causing service disruption, which violates fundamental principles of availability within the CIA triad of information security.
To mitigate this risk, it is imperative to apply the patch identified by commit hash 4b6a02dd1aff6428255db912563d77d4cb0a143e as soon as possible. This update introduces necessary validation logic that ensures range_start and range_end values are within acceptable bounds before they are processed by the audio engine. Organizations relying on vgmstream should verify their current version against this patch level and upgrade accordingly. Additionally, implementing input validation at network ingress points or using sandboxed environments for processing untrusted media files can provide defense-in-depth measures that limit the blast radius of such vulnerabilities.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation, as the root cause is the failure to verify user-supplied data against expected constraints. It also relates to CWE-400 Uncontrolled Resource Consumption, given the outcome of excessive CPU and memory usage due to malformed inputs. In terms of offensive security frameworks like MITRE ATT&CK, this flaw facilitates Denial of Service attacks (T1499) by allowing adversaries to exhaust system resources through crafted media files. Maintaining up-to-date software dependencies is critical in mitigating such risks, as vendors continuously address these logical flaws to ensure robust and secure audio processing capabilities across all supported platforms.