CVE-2026-76137: Missing authentication for critical function in Yamaha Corporation VOCALOID6

The vulnerability CVE-2026-76137 in VOCALOID6 involves missing authentication for a critical function accessible through a local named pipe. This allows processes running with the same local user privileges as the VOCALOID6 Editor instance to escalate their privileges locally. The CVSS 3.1 base score is 3.3, reflecting low severity with local attack vector, low complexity, and no user interaction required. Confidentiality impact is low, with no integrity or availability impact reported.

An attacker with local access under the same user account as VOCALOID6 Editor can escalate privileges via the vulnerable named pipe. The impact is limited to local privilege escalation with low confidentiality impact and no integrity or availability impact. There is no indication of remote exploitation or wider system compromise.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local user access and avoid running untrusted processes under the same user account as VOCALOID6 Editor to mitigate risk.