Heap Out-of-Bounds Read in libvgm PCM Decompressor

Executive Summary

This is a heap out-of-bounds read vulnerability in ValleyBell libvgm's PCM data-block decompressor. It occurs when a crafted .vgm file uses a small compression table but contains wider compressed values. The DecompressDataBlk function reads these values as indices without bounds checking, causing it to over-read heap memory and potentially crash applications using the library.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires analyzing libvgm usage in applications processing VGM/S98/DRO/GYM files. Monitor for crashes in media players using libvgm during file decompression. Check for out-of-bounds reads in dblk_compr.c functions like Decompress_BitPacking_8. Use static analysis tools to scan for missing bounds checks in decompression code.

Useful 0 Not Useful 0

Impact Analysis

If you use applications that rely on libvgm (like VGMPlay or foobar2000) to play music files, an attacker could exploit this flaw by providing a malicious .vgm file. This could crash the application, corrupt memory, or potentially allow arbitrary code execution, depending on the system and context.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA. It is a technical flaw in a media library that could cause crashes or memory corruption when processing crafted audio files. Compliance impacts would depend on how the affected library is used in a system handling personal or health data.

Useful 0 Not Useful 0

Mitigation Strategies

Update libvgm to the latest commit beyond a6eed945. If unavailable, disable media players using libvgm for untrusted files. Implement file validation to reject malformed VGM files. Add runtime bounds checks in decompression functions. Monitor for crashes in applications using libvgm.

Useful 0 Not Useful 0