CVE-2026-105249
vgmstream TXTP File txtp_process.c make_group_random use after free
n/a vgmstream
CVSS
2.4LowExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.10%Chance of exploitation activity in the next 30 days, higher than 1% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
A weakness has been identified in vgmstream up to r2117. This impacts the function make_group_random of the file src/meta/txtp_process.c of the component TXTP File Handler. This manipulation causes use after free. The attack needs to be launched locally. Patch name: ae37662ad626254ddd96ad69ac263792d7a92024. It is recommended to apply a patch to fix this issue.
Text from CVE List
Affected versions 1
- vgmstreamaffected: r2117CVE List
References 8
- github.com/vgmstream/vgmstream/pull/2008Fixvia CVE List
- github.com/vgmstream/vgmstream/commit/ae37662ad626254ddd96ad69ac263792d7a92024Fixvia CVE List
- vuldb.com/cve/CVE-2026-105249Advisoryvia CVE List
- vuldb.com/submit/976279Advisoryvia CVE List
- vuldb.com/vuln/413456Referencevia CVE List
- vuldb.com/vuln/413456/ctiReferencevia CVE List
- github.com/vgmstream/vgmstream/issues/1998Referencevia CVE List
- github.com/vgmstream/vgmstream/Referencevia CVE List