CVE-2026-104679: Improper restriction of XML external entity reference in Yamaha Corporation VOCALOID6 Editor

CVE-2026-104679 describes an XML external entity (XXE) vulnerability in Yamaha Corporation's VOCALOID6 Editor. The product improperly restricts XML external entity references, which can be exploited by loading a specially crafted project file. This may lead to unintended network communication, potentially leaking sensitive information from the device or causing a denial-of-service condition. The vulnerability affects VOCALOID6 Editor versions up to and including 6.13.2. The CVSS 3.1 base score is 7.1, with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H, indicating local attack vector, low complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, no integrity impact, and high availability impact.

Successful exploitation can lead to leakage of sensitive information from the affected device and denial-of-service conditions in the VOCALOID6 Editor application. The confidentiality and availability impacts are rated high, while integrity is not impacted. The attack requires local access and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid opening untrusted or specially crafted project files in VOCALOID6 Editor. Monitor official Yamaha Corporation advisories for updates and patches addressing this vulnerability.