CVE-2026-92880 in vgmstream
Summary
by MITRE • 09/17/2026
A weakness has been identified in vgmstream up to r2117. Impacted is the function vadpcm_read_coefs_be of the file src/coding/vadpcm_decoder.c of the component EA SCHl parser. This manipulation of the argument entry/entries causes out-of-bounds write. Remote exploitation of the attack is possible. Patch name: ae37662ad626254ddd96ad69ac263792d7a92024. It is suggested to install a patch to address this issue.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in vgmstream prior to revision r2117 represents a critical memory safety flaw within the EA SCHl audio parser component, specifically affecting the vadpcm_read_coefs_be function located in src/coding/vadpcm_decoder.c. This software is widely used for decoding various video game music and sound effects formats, making it a common target for processing untrusted or maliciously crafted media files. The core technical issue stems from an improper validation of input arguments passed to the decoder routine. When parsing EA SCHl formatted audio data, the function fails to adequately verify that the coefficients being read fall within the bounds of the allocated memory buffer. This lack of rigorous boundary checking allows for a manipulation of the entry or entries provided in the malformed file header or stream data, leading directly to an out-of-bounds write condition.
From a technical perspective, this flaw is classified under CWE-787: Out-of-Bounds Write, which occurs when software writes data to a memory location beyond the intended boundary of the buffer. In the context of vgmstream, the vadpcm_read_coefs_be function is responsible for extracting Adaptive Differential Pulse Code Modulation coefficients used in decompressing audio streams. If an attacker crafts a malicious EA SCHl file with specifically engineered coefficient values or array indices that exceed the allocated size, the application will write data to arbitrary memory locations adjacent to the buffer. This type of vulnerability is particularly dangerous because it can lead to heap corruption, which often results in application crashes but more critically enables remote code execution if an attacker can control the content written and the subsequent state of the program's memory layout.
The operational impact of this vulnerability is severe due to its potential for remote exploitation. Since vgmstream is frequently integrated into media players, game engines, or automated audio processing pipelines that may process files from untrusted sources, an adversary could distribute a maliciously crafted EA SCHl file via email attachments, web downloads, or network shares. Upon opening this file with a vulnerable version of vgmstream, the out-of-bounds write can be triggered without any user interaction beyond initiating playback or analysis. This aligns with ATT&CK technique T1203: Exploitation for Client Execution, where attackers leverage vulnerabilities in client-side applications to gain initial access and execute arbitrary code on the victim's system. The ability to achieve remote exploitation means that this flaw can serve as a vector for installing malware, establishing persistent backdoors, or escalating privileges within an affected environment.
To mitigate this risk, it is imperative to upgrade vgmstream to version r2117 or later, which includes patch ae37662ad626254ddd96ad69ac263792d7a92024. This update addresses the root cause by implementing proper bounds checking within the vadpcm_read_coefs_be function to ensure that all coefficient entries are validated against the allocated buffer size before being processed. Organizations and individual users relying on vgmstream for audio decoding should verify their current version and apply this patch immediately. Additionally, defensive measures such as deploying file type validation tools at network entry points or using sandboxed environments for processing untrusted media files can provide an additional layer of security against exploitation attempts while the software ecosystem updates to fully patched versions.