Medium severity4.8NVD Advisory· Published Oct 5, 2026

CVE-2026-105249

Description

A weakness has been identified in vgmstream up to r2117. This impacts the function make_group_random of the file src/meta/txtp_process.c of the component TXTP File Handler. This manipulation causes use after free. The attack needs to be launched locally. Patch name: ae37662ad626254ddd96ad69ac263792d7a92024. It is recommended to apply a patch to fix this issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Vgmstream/Vgmstreamllm-fuzzy
Range: <=r2117

Patches

Vulnerability mechanics

References

github.com/vgmstream/vgmstream/commit/ae37662ad626254ddd96ad69ac263792d7a92024nvd
github.com/vgmstream/vgmstream/issues/1998nvd
github.com/vgmstream/vgmstream/pull/2008nvd
vuldb.com/cve/CVE-2026-105249nvd
vuldb.com/submit/976279nvd
vuldb.com/vuln/413456nvd
vuldb.com/vuln/413456/ctinvd

News mentions

No linked articles in our index yet.

cvss	0.312
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000