CVE-2026-110660 Details
Description
vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the G.722.1/Siren14 decoder in g7221_lib.c, whose bit reader refills without checking the data_u32 array end. Attackers can supply crafted .s14 or .sss files that drive decode_vector_quantized_mlt_indices() past the stack buffer during format detection, crashing the application.
A stack out-of-bounds read vulnerability has been identified in vgmstream versions through r2117, specifically within the G.722.1/Siren14 decoder. The issue arises because the decoder's bit reader refills without properly checking the end of the data_u32 array. This flaw allows attackers to craft .s14 or .sss files that manipulate the decoding process, causing it to exceed the bounds of the stack buffer during format detection, which can lead to application crashes.
To address this vulnerability, the G.722.1 decoder should be modified to include proper bounds checks before refilling the bit reader. Additionally, the decoder's buffer size should be hard-capped to prevent overflows from crafted frames.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/vgmstream/vgmstream | [email protected] | Source CodeVendor |
| https://github.com/vgmstream/vgmstream/blob/71e2361042531fe767fb98300cf8c1ee95e539a0/src/coding/libs/g7221_lib.c#L838 | [email protected] | Source CodeVendor |
| https://hackmd.io/@haind-pwn/vgmstream-g7221-bitreader-oob-read | [email protected] | ExploitTechnical Analysis |
| https://www.vulncheck.com/advisories/vgmstream-through-r2117-stack-out-of-bounds-read-via-g-722.1-siren14-decoder | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vgmstream | <r2117 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |