CVE-2026-86514: Stack-based Buffer Overflow in vgmstream
CVE-2026-86514 is a stack-based buffer overflow vulnerability in the vgmstream software, specifically in the sscanf function within src/meta/txth.c of the txth-txtp component. The issue affects version r2117 and allows remote attackers to cause a buffer overflow. Exploit code has been publicly released. A patch identified by commit 4669d37a6af94866f6f0628678f9f90d46954e8b is recommended to fix the vulnerability.
AI Analysis
Technical Summary
This vulnerability in vgmstream up to version r2117 involves improper handling in the sscanf function in src/meta/txth.c, leading to a stack-based buffer overflow. The flaw is remotely exploitable and publicly available exploit code exists. The vulnerability has a CVSS 4.0 score of 5.3, indicating medium severity. A patch commit 4669d37a6af94866f6f0628678f9f90d46954e8b has been identified to remediate the issue.
Potential Impact
Successful exploitation of this vulnerability could allow remote attackers to trigger a stack-based buffer overflow, potentially leading to denial of service or code execution with the privileges of the vgmstream process. The CVSS score of 5.3 reflects a medium impact with low complexity and no privileges required.
Mitigation Recommendations
A patch identified by commit 4669d37a6af94866f6f0628678f9f90d46954e8b is recommended to fix this vulnerability. Users should apply this patch to vgmstream version r2117 to remediate the issue. No official vendor advisory or remediation level is provided, so verify patch availability from the vendor or source repository.
CVE-2026-86514: Stack-based Buffer Overflow in vgmstream
Description
CVE-2026-86514 is a stack-based buffer overflow vulnerability in the vgmstream software, specifically in the sscanf function within src/meta/txth.c of the txth-txtp component. The issue affects version r2117 and allows remote attackers to cause a buffer overflow. Exploit code has been publicly released. A patch identified by commit 4669d37a6af94866f6f0628678f9f90d46954e8b is recommended to fix the vulnerability.
CVSS v4.0
Score 5.3medium
Affected software
cpe:2.3:a:vgmstream:vgmstream:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in vgmstream up to version r2117 involves improper handling in the sscanf function in src/meta/txth.c, leading to a stack-based buffer overflow. The flaw is remotely exploitable and publicly available exploit code exists. The vulnerability has a CVSS 4.0 score of 5.3, indicating medium severity. A patch commit 4669d37a6af94866f6f0628678f9f90d46954e8b has been identified to remediate the issue.
Potential Impact
Successful exploitation of this vulnerability could allow remote attackers to trigger a stack-based buffer overflow, potentially leading to denial of service or code execution with the privileges of the vgmstream process. The CVSS score of 5.3 reflects a medium impact with low complexity and no privileges required.
Mitigation Recommendations
A patch identified by commit 4669d37a6af94866f6f0628678f9f90d46954e8b is recommended to fix this vulnerability. Users should apply this patch to vgmstream version r2117 to remediate the issue. No official vendor advisory or remediation level is provided, so verify patch availability from the vendor or source repository.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-09-07T19:18:11.905Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a9f787cacd9273b49ddda3a
Added to database: 09/08/2026, 02:52:44 UTC
Last enriched: 09/08/2026, 03:07:56 UTC
Last updated: 09/08/2026, 03:13:19 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.