| Title | vgmstream r2117 Use After Free |
|---|
| Description | vgmstream contains a CWE-416 vulnerability in make_group_random() in src/meta/txtp_process.c. The function can move the selected stream into the shared list with update_vgmstream_list(), then call make_group_segment() on that stream. If segment creation fails, the selected object may already have been freed by the callee, but the caller still reaches the shared fail path and closes the stale local pointer again. A crafted TXTP file can therefore trigger a use-after-free during random-group failure cleanup, causing process termination and potentially enabling further memory corruption.
I re-verified this issue against the latest upstream HEAD commit 79bc65b52cddc61b859679c1c47dc57092872ae1 on 2026-08-21 and confirmed that the vulnerable logic is still present there.
Affected component / root cause: txtp:random-group-failed-segment-transfer-double-closes-selected-stream
CWE: CWE-416
CVSS v3.1 draft: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
|---|
| Source | ⚠️ https://github.com/vgmstream/vgmstream/issues/1998 |
|---|
| User | ni-liao (UID 98297) |
|---|
| Submission | 09/13/2026 16:31 (21 days ago) |
|---|
| Moderation | 10/04/2026 19:37 (21 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 413456 [vgmstream up to r2117 TXTP File src/meta/txtp_process.c make_group_random use after free] |
|---|
| Points | 20 |
|---|