| शीर्षक | vgmstream r2117 Use After Free |
|---|
| विवरण | vgmstream contains a CWE-416 vulnerability in make_group_random() in src/meta/txtp_process.c. The function can move the selected stream into the shared list with update_vgmstream_list(), then call make_group_segment() on that stream. If segment creation fails, the selected object may already have been freed by the callee, but the caller still reaches the shared fail path and closes the stale local pointer again. A crafted TXTP file can therefore trigger a use-after-free during random-group failure cleanup, causing process termination and potentially enabling further memory corruption.
I re-verified this issue against the latest upstream HEAD commit 79bc65b52cddc61b859679c1c47dc57092872ae1 on 2026-08-21 and confirmed that the vulnerable logic is still present there.
Affected component / root cause: txtp:random-group-failed-segment-transfer-double-closes-selected-stream
CWE: CWE-416
CVSS v3.1 draft: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
|---|
| स्रोत | ⚠️ https://github.com/vgmstream/vgmstream/issues/1998 |
|---|
| उपयोगकर्ता | ni-liao (UID 98297) |
|---|
| सबमिशन | 13/09/2026 04:31 PM (21 दिन पहले) |
|---|
| संयम | 04/10/2026 07:37 PM (21 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 413456 [vgmstream तक r2117 TXTP File src/meta/txtp_process.c make_group_random बफ़र ओवरफ़्लो] |
|---|
| अंक | 20 |
|---|