Threat database

VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references. Loading a specially crafted project file may the product to initiate unintended communication, potentially leading to the leak of sensitive information from the device where the product is installed or resulting in a denial-of-service (DoS) condition.

CVE-2026-76137 is a vulnerability in Yamaha Corporation's VOCALOID6 software where a critical function lacks authentication. This flaw allows any process running under the same local user account as the VOCALOID6 Editor to potentially escalate privileges via a local named pipe. The vulnerability has a low severity score and affects versions from 0 up to and including 6.13.1.

CVE-2026-76131 is a vulnerability in Yamaha Corporation's VOCALOID6 software involving the use of hard-coded credentials. This flaw could allow an attacker to impersonate a legitimate VOCALOID6 Editor and access Yamaha's activation and content servers. The vulnerability affects versions from 0 up to and including 6.13.0. It has a CVSS v3.1 base score of 5.3, indicating medium severity. No known exploits are reported in the wild, and no patch or remediation information is provided.