Description

A security vulnerability has been detected in vgmstream up to r2117. Impacted is the function add_entry of the file src/meta/txtp_parser.c of the component txtp. Such manipulation of the argument range_start/range_end leads to resource consumption. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The name of the patch is 4b6a02dd1aff6428255db912563d77d4cb0a143e. It is advisable to implement a patch to correct this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-08T03:17:19.987Z",
  "pubdate": "2026-09-08T03:17:19.987Z",
  "executiveSummary": "A resource consumption vulnerability exists within vgmstream up to version r2117, specifically affecting the txtp component.\nThe vulnerability is located in the add_entry function within src/meta/txtp_parser.c, where improper validation of range_start and range_end arguments allows an attacker to trigger excessive resource usage.\nThe flaw can be exploited remotely, posing a significant risk of Denial of Service (DoS) by exhausting system resources.\nBecause the exploit has been disclosed publicly, the risk of active exploitation is elevated.\nUsers and maintainers are strongly advised to apply the identified patch (4b6a02dd1aff6428255db912563d77d4cb0a143e) to remediate this issue.",
  "technicalDetails": "The vulnerability resides in the add_entry function within the txtp_parser.c file, which is responsible for parsing TXTP (text-based stream description) files in vgmstream.\nThe root cause of this vulnerability is improper input validation concerning the range_start and range_end parameters during the parsing process. When vgmstream processes a TXTP file, it uses these parameters to define segments of audio data. If these values are manipulated maliciously—for instance, by providing extreme or logically inconsistent values—the parsing logic fails to enforce appropriate bounds or sanity checks.\nThe attack flow begins when an attacker provides a maliciously crafted TXTP file to the target application that utilizes the vgmstream library. The vulnerability is reachable from remote, meaning the attack can be executed if the application processes untrusted TXTP files from external sources.\nUpon processing the malformed range arguments within add_entry, the application attempts to allocate excessive memory or enter an inefficient loop structure, leading to resource exhaustion. This behavior effectively causes the process to consume disproportionate CPU cycles or system memory, leading to a Denial of Service (DoS) condition.\nThe exploitation does not require authentication or elevated privileges, provided the attacker can influence the input file processed by vgmstream. The exploit is public, meaning attackers can easily craft payloads that target this specific logic flaw in the TXTP parser.\nThe impact is primarily a Denial of Service, which may crash the host application or render it unresponsive, disrupting audio processing services. The vulnerability affects all versions of vgmstream up to r2117. Remediation requires applying the patch 4b6a02dd1aff6428255db912563d77d4cb0a143e, which introduces necessary bounds checking and input sanitization for the range parameters, preventing the parser from entering the identified exhaustion state."
}