CVE-2026-105249
Received Received - Intake

Use After Free in vgmstream TXTP File Handler

Publication date: 2026-10-05

Last updated on: 2026-10-05

Assigner: VulDB

Description
A weakness has been identified in vgmstream up to r2117. This impacts the function make_group_random of the file src/meta/txtp_process.c of the component TXTP File Handler. This manipulation causes use after free. The attack needs to be launched locally. Patch name: ae37662ad626254ddd96ad69ac263792d7a92024. It is recommended to apply a patch to fix this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-05
Last Modified
2026-10-05
Generated
2026-10-05
AI Q&A
2026-10-05
EPSS Evaluated
N/A
NVD
CVE-2026-105249
EUVD
EUVD-2026-92276

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vgmstream vgmstream to r2117 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a use-after-free issue in vgmstream up to r2117. It occurs in the function make_group_random() in src/meta/txtp_process.c when handling TXTP files. The flaw allows a locally launched attack to trigger a second close of a previously freed VGMSTREAM object during cleanup, leading to memory corruption or process termination.

Detection Guidance

This vulnerability is specific to vgmstream's TXTP file handling and requires local access to trigger. Detection involves checking for the use of vulnerable vgmstream versions (up to r2117) and analyzing TXTP files for crafted inputs. Monitor system logs for crashes or memory corruption during audio file processing. Use static analysis tools to inspect vgmstream code for the described use-after-free pattern in make_group_random().

Commands: Check vgmstream version with 'vgmstream-cli -v' or 'find / -name vgmstream* 2>/dev/null'. Analyze TXTP files with 'file *.txtp' and inspect contents for unusual structures. Enable core dumps with 'ulimit -c unlimited' to capture crashes for forensic analysis.

Impact Analysis

An attacker could exploit this to cause crashes, memory corruption, or execute arbitrary code on your system. Since the attack is local, it requires access to the vulnerable system or file processing. This could affect media players or applications using vgmstream for audio playback.

Compliance Impact

This vulnerability is a local use-after-free issue in vgmstream's TXTP file handler, which could lead to process termination or memory corruption. It does not directly involve data exposure or unauthorized access, so its impact on compliance with GDPR or HIPAA is likely minimal unless the affected system processes sensitive audio data in a regulated environment.

Mitigation Strategies

Apply the patch from commit ae37662ad626254ddd96ad69ac263792d7a92024 or upgrade to a version beyond r2117. If immediate patching is not possible, restrict access to systems processing TXTP files and avoid using untrusted TXTP inputs. Monitor for crashes or memory corruption in audio processing applications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105249. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart