CVE-2026-111150: Out-of-bounds Read in ValleyBell libvgm
Description
CVE-2026-111150 is a medium severity heap out-of-bounds read vulnerability in ValleyBell's libvgm library. It occurs in the PCM data-block decompressor due to an unbounded compression-table index. A crafted .vgm file with a small type 0x7F table and wider compressed values can trigger the vulnerability, causing the decompressor to read beyond heap memory and crash.
CVSS v4.0
Score 6.8medium
Affected software
ValleyBell
libvgm
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
ValleyBell libvgm through commit a6eed945 contains a heap out-of-bounds read vulnerability in the PCM data-block decompressor. This is caused by an unbounded compression-table index that allows an attacker to supply a specially crafted .vgm file with a small type 0x7F table and wider compressed values. This crafted input causes the DecompressDataBlk function to over-read heap memory, potentially crashing applications that consume the decompressed data.
Potential Impact
The vulnerability can cause heap memory to be read out-of-bounds, leading to application crashes. There is no indication of code execution or data corruption beyond the crash. The CVSS 4.0 score is 6.8 (medium severity), reflecting local attack vector, low complexity, no privileges required, user interaction required, and high impact on availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, avoid processing untrusted or suspicious .vgm files with libvgm to mitigate risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-15T17:03:59.914Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad123b62cdf04f65652b704
Added to database: 10/15/2026, 19:04:22 UTC
Last enriched: 10/15/2026, 19:48:20 UTC
Last updated: 10/15/2026, 19:48:20 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.