| शीर्षक | vgmstream r2117 Stack-based Buffer Overflow |
|---|
| विवरण | vgmstream r2117 contains a CWE-121 vulnerability in the txth-txtp component. Crafted TXTH or TXTP text input can overwrite stack memory during media-file parsing, causing application termination and potentially enabling code execution in applications embedding vgmstream.
Affected component / root cause:
txth-txtp:sscanf-unbounded-scansets-to-fixed-stack-buffers
Technical details:
The TXTH and TXTP text parsers use unbounded sscanf() scansets to copy
attacker-controlled keys, values, and filenames into fixed-size stack buffers.
An overlong field therefore writes past the destination array before semantic
validation occurs. The proposed fix adds field widths matching the destination
buffers to every affected scanset.
Attacker-controlled data:
An attacker controls the bytes of a TXTH or TXTP text file; an overlong key, value, or TXTP filename crosses a fixed-size stack buffer boundary.
The minimized testcase has SHA-256 cd624ea92d99f1d3b48459ae1ca7573d1a049ff0b711594bc231586058562356. It reproduced
three times on the identified release and three times on the tested current
branch using AddressSanitizer and/or UndefinedBehaviorSanitizer. The linked
upstream issue contains the sanitizer harness, testcase, build instructions,
reproduction command, expected diagnostic output, and a proposed defensive
patch.
CWE: CWE-121
CVSS v3.1 draft: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
|---|
| स्रोत | ⚠️ https://github.com/vgmstream/vgmstream/issues/1972 |
|---|
| उपयोगकर्ता | ni-liao (UID 98297) |
|---|
| सबमिशन | 29/07/2026 07:52 AM (1 महीना पहले) |
|---|
| संयम | 07/09/2026 09:18 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 399668 [vgmstream तक r2117 txth-txtp src/meta/txth.c sscanf बफ़र ओवरफ़्लो] |
|---|
| अंक | 20 |
|---|