Vulnerability · Published Sep 17, 2026 · Assigned by VulDB

CVE-2026-92879vgmstream mus_acm.c parse_mus resource consumption

Medium 4.3

In plain English

A medium-severity uncontrolled resource consumption in vgmstream. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.6%top 51.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in vgmstream up to r2117. This issue affects the function parse_mus of the file src/meta/mus_acm.c. The manipulation results in resource consumption. The attack may be launched remotely. The patch is identified as ae37662ad626254ddd96ad69ac263792d7a92024. Applying a patch is advised to resolve this issue.

Affected products (as reported)

Vendor	Product	Versions
n/a	vgmstream	r2117

Weakness: CWE-400, CWE-404 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C

References

VDB-406345 | vgmstream mus_acm.c parse_mus resource consumption vdb-entry, technical-description
VDB-406345 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-92879 | CVE Analysis and Report third-party-advisory
Submit #942160 | vgmstream r2117 Resource Consumption third-party-advisory
https://github.com/vgmstream/vgmstream/issues/1993 issue-tracking
https://github.com/vgmstream/vgmstream/pull/2008 issue-tracking, patch
https://github.com/vgmstream/vgmstream/commit/ae37662ad626254ddd96ad69ac263792d7a92024 patch
https://github.com/vgmstream/vgmstream/ product