| 제목 | vgmstream r2117 Use After Free |
|---|
| 설명 | vgmstream contains a CWE-416 vulnerability in make_group_random() in src/meta/txtp_process.c. The function can move the selected stream into the shared list with update_vgmstream_list(), then call make_group_segment() on that stream. If segment creation fails, the selected object may already have been freed by the callee, but the caller still reaches the shared fail path and closes the stale local pointer again. A crafted TXTP file can therefore trigger a use-after-free during random-group failure cleanup, causing process termination and potentially enabling further memory corruption.
I re-verified this issue against the latest upstream HEAD commit 79bc65b52cddc61b859679c1c47dc57092872ae1 on 2026-08-21 and confirmed that the vulnerable logic is still present there.
Affected component / root cause: txtp:random-group-failed-segment-transfer-double-closes-selected-stream
CWE: CWE-416
CVSS v3.1 draft: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
|---|
| 원천 | ⚠️ https://github.com/vgmstream/vgmstream/issues/1998 |
|---|
| 사용자 | ni-liao (UID 98297) |
|---|
| 제출 | 2026. 09. 13. PM 04:31 (22 날 ago) |
|---|
| 모더레이션 | 2026. 10. 04. PM 07:37 (21 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 413456 [vgmstream 까지 r2117 TXTP File src/meta/txtp_process.c make_group_random 메모리 손상] |
|---|
| 포인트들 | 20 |
|---|