CVE-2026-92880 vgmstream CVE debrief

Who should care

Defenders responsible for systems using vgmstream up to r2117 should assess exposure and apply the patch (ae37662ad626254ddd96ad69ac263792d7a92024) to mitigate the vulnerability. This includes operators, platform administrators, and security teams who need to review and update inventory of affected systems, perform vulnerability scanning, and implement compensating controls for exposed systems.

Why it matters

CVE-2026-92880 is an out-of-bounds write vulnerability in vgmstream up to r2117, which can be exploited remotely. Defenders should assess exposure, apply the patch, and monitor for potential exploitation attempts.

• Remote exploitation of the vulnerability is possible.
• The vulnerability can lead to an out-of-bounds write, potentially causing system instability or crashes.
• Defenders should verify if the patch has been applied to prevent potential exploitation.
• The vulnerability has a medium CVSS score of 5.3, indicating a moderate level of risk.

Technical summary

The vadpcm_read_coefs_be function in src/coding/vadpcm_decoder.c of vgmstream up to r2117 is vulnerable to an out-of-bounds write attack when manipulating the argument entry/entries. This weakness can be exploited remotely, potentially causing system instability or crashes. Defenders should assess exposure, apply the patch (ae37662ad626254ddd96ad69ac263792d7a92024), and monitor for potential exploitation attempts to mitigate the vulnerability. The vulnerability has a medium CVSS score of 5.3, indicating a moderate level of risk.

Defensive priority

Medium priority given the CVSS score of 5.3 and the availability of a patch.

Recommended defensive actions

• Assess exposure by checking if the vulnerable version of vgmstream (up to r2117) is in use.
• Verify if the patch (ae37662ad626254ddd96ad69ac263792d7a92024) has been applied.
• Monitor for potential exploitation attempts.
• Review and update inventory of affected systems.
• Perform vulnerability scanning to identify instances of vgmstream up to r2117.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its description, CVSS score, and affected versions. However, the vendor and product names are not specified, and the CVE record does not provide additional information on exploitation or impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.