CVE-2026-104679
Received Received - Intake

XML External Entity Processing in VOCALOID6 Editor

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: JPCERT/CC

Description
VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references. Loading a specially crafted project file may the product to initiate unintended communication, potentially leading to the leak of sensitive information from the device where the product is installed or resulting in a denial-of-service (DoS) condition.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-104679
EUVD
EUVD-2026-104124

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Yamaha Corporation VOCALOID6 Editor 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-611 The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-104679 is an improper restriction of XML external entity (XXE) reference vulnerability in Yamaha Corporation's VOCALOID6 Editor. It allows attackers to load specially crafted project files, potentially causing unintended communication that may lead to sensitive information leaks or denial-of-service conditions on the affected device.

Impact Analysis

This vulnerability could allow attackers to steal sensitive information from your device or cause it to crash through a denial-of-service attack. It specifically affects VOCALOID6 Editor versions 6.13.2 and earlier.

Mitigation Strategies
  • Update VOCALOID6 Editor to version 6.13.3 or later using the official updater.
  • Ensure VOCALOID6 Voicebanks are updated to version 6.3.0 or later.
  • Apply the VOCALO CHANGER PLUGIN update to version 1.2.3 or later.
  • Avoid opening untrusted project files (.vsqx or .vpr) until updates are applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104679. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart