CVE-2026-105248— vgmstream TXTP File txtp_parser.c txtp_parse out-of-bounds write
Quick assessment
Affected
n/a vgmstream
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 vgmstream 2117 版本之前发现了一个安全漏洞。该漏洞影响组件 TXTP 文件处理程序（TXTP File Handler）中 src/meta/txtp_parser.c 文件的 parse_params/txtp_parse 函数。漏洞利用可导致越界写入（out-of-bounds write）。攻击者可能通过远程方式发起攻击。相关补丁标识为 4669d37a6af94866f6f0628678f9f90d46954e8b。建议及时应用补丁以修复该问题。
Possible ATT&CK Techniques 2 AI
T1203 · Exploitation for Client Execution T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-105248
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
vgmstream TXTP File txtp_parser.c txtp_parse out-of-bounds write
Source: CVE Program / CVE List V5
Vulnerability Description
A security flaw has been discovered in vgmstream up to r2117. This affects the function parse_params/txtp_parse of the file src/meta/txtp_parser.c of the component TXTP File Handler. The manipulation results in out-of-bounds write. The attack may be launched remotely. The patch is identified as 4669d37a6af94866f6f0628678f9f90d46954e8b. It is best practice to apply a patch to resolve this issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | vgmstream | r2117 |
cpe:2.3:a:vgmstream:vgmstream:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-105248
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-105248
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-105248 (1)
Proof of Concept for CVE-2026-105248 (1)
Other References for CVE-2026-105248 (4)
-
https://github.com/vgmstream/vgmstream/issues/1997 issue-tracking
-
https://vuldb.com/cve/CVE-2026-105248 third-party-advisory
-
-
https://vuldb.com/submit/976278 third-party-advisory
Same Patch Batch · n/a · 2026-10-05 · 6 CVEs total
| CVE-2026-105251 | 6.3 MEDIUM | vgmstream VAG File psx_decoder.c ps_find_padding out-of-bounds |
| CVE-2026-105180 | 6.3 MEDIUM | Jeebase UserService info updateUser dynamically-determined object attributes |
| CVE-2026-105174 | 5.4 MEDIUM | Gerapy Project Management views.py project_create path traversal |
| CVE-2026-105249 | 4.8 MEDIUM | vgmstream TXTP File txtp_process.c make_group_random use after free |
| CVE-2026-105250 | 4.3 MEDIUM | vgmstream Microsoft IMA Decoder ima_decoder.c decode_ms_ima divide by zero |
IV. Related Vulnerabilities
Same product: vgmstream
-
CVE-2026-105251
vgmstream VAG File psx_decoder.c ps_find_padding out-of-boun -
CVE-2026-105250
vgmstream Microsoft IMA Decoder ima_decoder.c decode_ms_ima -
CVE-2026-105249
vgmstream TXTP File txtp_process.c make_group_random use aft -
CVE-2026-92881
vgmstream AWB parser awb.c init_vgmstream_awb_memory divide -
CVE-2026-92880
vgmstream EA SCHl parser vadpcm_decoder.c vadpcm_read_coefs_
Same vendor: n/a
-
CVE-2026-105251
vgmstream VAG File psx_decoder.c ps_find_padding out-of-boun -
CVE-2026-105250
vgmstream Microsoft IMA Decoder ima_decoder.c decode_ms_ima -
CVE-2026-105249
vgmstream TXTP File txtp_process.c make_group_random use aft -
CVE-2026-105180
Jeebase UserService info updateUser dynamically-determined o -
CVE-2026-105174
Gerapy Project Management views.py project_create path trave
V. Comments for CVE-2026-105248
No comments yet