CVE-2026-111150 Details
Description
ValleyBell libvgm through commit a6eed945 contains a heap out-of-bounds read vulnerability in the PCM data-block decompressor caused by an unbounded compression-table index. Attackers can supply a crafted .vgm file with a small type 0x7F table and wider compressed values, causing DecompressDataBlk to over-read heap memory and crash consumers.
A heap out-of-bounds read vulnerability has been identified in ValleyBell's libvgm library, specifically in the PCM data-block decompressor. This vulnerability arises from an unbounded index into the compression table, allowing attackers to craft a .vgm file that exploits the flaw. The issue is present in libvgm versions through commit a6eed945. When the manipulated file is processed, the 'DecompressDataBlk' function over-reads heap memory, leading to a crash in the application.
Users are advised to update to the latest version of ValleyBell libvgm, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ValleyBell libvgm | <a6eed945ecf4e5a25cf82004779c6f7e4fd5c319 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 21, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |