CVE-2026-92879 Details

A denial-of-service vulnerability has been identified in vgmstream versions prior to r2117. The issue arises in the 'parse_mus' function within 'src/meta/mus_acm.c', where the program improperly handles the track count in '.MUS' playlists. This flaw allows for excessive memory allocation based on an attacker-controlled value, leading to resource exhaustion. The vulnerability can be exploited remotely by crafting a specific '.MUS' file that forces the application to allocate large amounts of memory before validating the audio files associated with the playlist.

Users are advised to update to vgmstream version r2118 or later, where this vulnerability has been addressed.