Vulnerability · Published Oct 5, 2026 · Assigned by VulDB
CVE-2026-105249vgmstream TXTP File txtp_process.c make_group_random use after free
Medium 4.8
In plain English
A medium-severity use-after-free in vgmstream. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).
Severity (CVSS 3.1)4.8Medium
Exploit odds (30 days)0.1%top 98.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A weakness has been identified in vgmstream up to r2117. This impacts the function make_group_random of the file src/meta/txtp_process.c of the component TXTP File Handler. This manipulation causes use after free. The attack needs to be launched locally. Patch name: ae37662ad626254ddd96ad69ac263792d7a92024. It is recommended to apply a patch to fix this issue.
Affected products (as reported)
Weakness: CWE-416, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C
References
- VDB-413456 | vgmstream TXTP File txtp_process.c make_group_random use after free vdb-entry, technical-description
- VDB-413456 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- CVE-2026-105249 | CVE Analysis and Report third-party-advisory
- Submit #976279 | vgmstream r2117 Use After Free third-party-advisory
- https://github.com/vgmstream/vgmstream/issues/1998 issue-tracking
- https://github.com/vgmstream/vgmstream/pull/2008 issue-tracking, patch
- https://github.com/vgmstream/vgmstream/commit/ae37662ad626254ddd96ad69ac263792d7a92024 patch
- https://github.com/vgmstream/vgmstream/ product