CVE-2026-105249 vgmstream CVE debrief

Who should care

System administrators and developers using vgmstream should assess exposure and apply the patch. This vulnerability could potentially allow local attackers to cause a denial of service or execute arbitrary code if exploited. Verify patch application and update vgmstream to prevent exploitation. It is crucial to review and update vgmstream to version r2117 or later. Local attackers could exploit this vulnerability to cause a denial of service or potentially

Why it matters

CVE-2026-105249 is a local use-after-free vulnerability in vgmstream that requires patching to prevent potential denial of service or code execution.

• Local attackers could exploit this vulnerability to cause a denial of service or potentially execute arbitrary code.
• Successful exploitation requires local access to the system.
• Verify patch application and update vgmstream to prevent exploitation.
• Remediation priority is low due to the required local access.

Technical summary

The make_group_random function in src/meta/txtp_process.c of vgmstream up to r2117 is vulnerable to a use-after-free attack. This requires local access to exploit. The vulnerability could allow local attackers to cause a denial of service or potentially execute arbitrary code. The patch (ae37662) fixes this issue. It is recommended to apply the patch to fix this vulnerability. System administrators and developers should assess their exposure and apply the patch to prevent potential exploitation. The CVE record and NVD entry provide additional details on the vulnerability.

Defensive priority

Apply patch for local vulnerability in vgmstream

Recommended defensive actions

• Apply patch ae37662ad626254ddd96ad69ac263792d7a92024 to fix the use-after-free vulnerability in vgmstream
• Review and update vgmstream to version r2117 or later
• Verify local system access controls to prevent exploitation
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in vgmstream. The attack requires local access and a patch is available. The vulnerability was identified in vgmstream up to r2117, specifically in the make_group_random function of src/meta/txtp_process.c. The patch (ae37662) fixes the use-after-free vulnerability. Verify patch application and update vgmstream to prevent exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.