CVE-2026-110660

Deferred Deferred - Pending Action

Stack Out-of-Bounds Read in vgmstream G.722.1 Decoder

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the G.722.1/Siren14 decoder in g7221_lib.c, whose bit reader refills without checking the data_u32 array end. Attackers can supply crafted .s14 or .sss files that drive decode_vector_quantized_mlt_indices() past the stack buffer during format detection, crashing the application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110660

EUVD

EUVD-2026-101133

Affected Vendors & Products

Vendor	Product	Version / Range
vgmstream	vgmstream	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is a stack out-of-bounds read in the vgmstream library's G.722.1/Siren14 audio decoder. The issue occurs when the bit reader refills a fixed-size stack buffer without checking if it exceeds the buffer's end. Attackers can exploit this by providing specially crafted .s14 or .sss files that cause the decoder to read past the buffer during format detection, leading to application crashes.

Detection Guidance

Detecting this vulnerability requires checking for the vulnerable vgmstream version (r2117 or earlier) and analyzing audio files for crafted .s14 or .sss formats. Use vgmstream-cli with AddressSanitizer to test files for crashes during decoding. Monitor application logs for stack out-of-bounds errors when processing Siren14 audio files.

Impact Analysis

This vulnerability can cause the application using vgmstream to crash when processing malicious audio files. It may lead to denial of service but does not allow arbitrary code execution or data corruption based on current analysis. The impact is limited to a crash during file opening with no header or key required.

Compliance Impact

This vulnerability primarily causes application crashes due to stack out-of-bounds reads when processing crafted audio files. It does not directly impact data confidentiality or integrity, which are key concerns for GDPR and HIPAA compliance. However, repeated crashes could lead to denial-of-service scenarios, potentially disrupting systems handling sensitive data. No evidence suggests data exposure or unauthorized access, but operational disruptions may indirectly affect compliance with availability requirements in regulated environments.

Mitigation Strategies

Immediately update vgmstream to the latest version beyond r2117. Avoid opening untrusted .s14 or .sss files. If using vgmstream in applications, implement input validation for audio files. Consider disabling Siren14 support if not required. Monitor vendor updates for patches addressing the bit reader bounds issue.

Hi! I’m here to help you understand CVE-2026-110660. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70