CVE-2026-105249
4.8 MEDIUMpublic exploit availablePublished 2026-10-05 · Updated 2026-10-07
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
A weakness has been identified in vgmstream up to r2117. This impacts the function make_group_random of the file src/meta/txtp_process.c of the component TXTP File Handler. This manipulation causes use after free. The attack needs to be launched locally. Patch name: ae37662ad626254ddd96ad69ac263792d7a92024. It is recommended to apply a patch to fix this issue.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Weaknesses
CWE-119, CWE-416
Public exploit & PoC references
All references
- https://github.com/vgmstream/vgmstream/
- https://github.com/vgmstream/vgmstream/commit/ae37662ad626254ddd96ad69ac263792d7a92024
- https://github.com/vgmstream/vgmstream/issues/1998
- https://github.com/vgmstream/vgmstream/pull/2008
- https://vuldb.com/cve/CVE-2026-105249
- https://vuldb.com/submit/976279
- https://vuldb.com/vuln/413456
- https://vuldb.com/vuln/413456/cti
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2026-108538PoC
- MEDIUMCVE-2026-108539PoC
- MEDIUMCVE-2026-18785PoC
- HIGHCVE-2016-15060PoC
- CRITICALCVE-2026-0163
- HIGHCVE-2026-100200
- CRITICALCVE-2026-100202
- HIGHCVE-2026-100209
Related by shared AI tags and CWE weakness class. Browse the full archive.