Description

A weakness has been identified in vgmstream up to r2117. This issue affects the function sscanf of the file src/meta/txth.c of the component txth-txtp. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Patch name: 4669d37a6af94866f6f0628678f9f90d46954e8b. To fix this issue, it is recommended to deploy a patch.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-08T03:17:19.790Z",
  "pubdate": "2026-09-08T03:17:19.790Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability has been identified in vgmstream up to version r2117, specifically within the txth-txtp component.\nThe vulnerability originates from the unsafe use of the sscanf function in src/meta/txth.c, which fails to properly validate input length when parsing data.\nSuccessful exploitation allows for remote code execution or application crashes, posing a significant security risk to systems that process untrusted media files using affected versions of vgmstream.\nThe attack vector is remotely exploitable, requiring only that the victim processes a maliciously crafted file designed to trigger the overflow.\nPublicly available exploit code exacerbates the risk, as threat actors can leverage this vulnerability to execute arbitrary instructions in the context of the vgmstream process.\nOrganizations relying on vgmstream are advised to prioritize remediation by applying the recommended software patches immediately to prevent unauthorized system access or denial-of-service conditions.",
  "technicalDetails": "The vulnerability is a classic stack-based buffer overflow residing in the txth-txtp metadata parsing logic. The root cause is located in the src/meta/txth.c file, where the sscanf function is utilized to process input data without adequate bounds checking.\nWhen vgmstream attempts to parse a specially crafted TXTH file, the sscanf function reads data into a fixed-size buffer on the stack. Because the input length is not constrained, an attacker can provide a payload that exceeds the capacity of the destination buffer, resulting in memory corruption.\nThe attack flow commences when a user or automated system loads a malicious TXTH file. The vgmstream library invokes the vulnerable code path in src/meta/txth.c to interpret the file's metadata tags. As the input is processed, the sscanf call overflows the stack frame associated with the function.\nBy carefully crafting the malicious input, an attacker can overwrite critical stack data, including the function's return address. This allows for control over the instruction pointer (EIP/RIP) once the vulnerable function returns, facilitating the redirection of execution flow to attacker-controlled shellcode or return-oriented programming (ROP) chains.\nThe vulnerability is remotely exploitable, meaning an attacker does not require local access or specific privileges on the host system to initiate the attack; they merely need to supply the file to the application or service utilizing vgmstream.\nThe impact of successful exploitation is severe. Depending on the environment, an attacker could achieve arbitrary code execution, which grants the ability to read sensitive data, install persistent malware, or manipulate system files within the security context of the affected application process. If the overflow is not weaponized for code execution, it still results in an unhandled memory exception, triggering a crash and creating a denial-of-service (DoS) condition.\nThe vulnerability affects all versions of vgmstream up to r2117. The exposure is exacerbated by the existence of public exploit code, which lowers the barrier to entry for potential attackers. Remediation requires updating the library to a version where this buffer handling has been hardened, specifically incorporating the logic changes found in patch 4669d37a6af94866f6f0628678f9f90d46954e8b."
}