CVE-2026-105250 vgmstream CVE debrief

Who should care

Defenders responsible for systems or applications using vgmstream up to r2117 should assess exposure to remote attacks and verify the version in use. This includes operators, platform administrators, vulnerability management teams, and security teams who need to prioritize verifying the version in use, assessing exposure, and planning for remediation or mitigation if necessary.

Why it matters

CVE-2026-105250 is a medium-severity vulnerability in vgmstream up to r2117 that can be exploited remotely to cause a divide by zero error. Defenders should prioritize verifying the version in use and assessing exposure to remote attacks.

• Verify version of vgmstream in use
• Assess exposure to remote attacks
• Consider upgrading to a version of vgmstream beyond r2117 if available

Technical summary

The function decode_ms_ima in the file src/coding/ima_decoder.c of the Microsoft IMA Decoder component in vgmstream up to r2117 is vulnerable to a divide by zero attack. The attack can be executed remotely, and defenders should prioritize verifying the version in use and assessing exposure to remote attacks. The technical impact is a denial of service due to the divide by zero error. There is no indication of a code execution vector. Remediation involves verifying the version and considering an upgrade beyond r2117.

Defensive priority

Defenders should prioritize verifying the version of vgmstream in use and assessing exposure to remote attacks. Remediation priority is medium.

Recommended defensive actions

• Verify the version of vgmstream in use
• Assess exposure to remote attacks
• Consider upgrading to a version of vgmstream beyond r2117 if available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. The vendor and affected products are not clearly identified. Defenders should verify the version of vgmstream in use and assess exposure to remote attacks. The source confidence is limited, and further review of official advisories or source references is recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.