CVE-2026-104679: XEE
Published Oct 19, 2026
·Updated
VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references. Loading a specially crafted project file may the product to initiate unintended communication, potentially leading to the leak of sensitive information from the device where the product is installed or resulting in a denial-of-service (DoS) condition.
Affected Software
1 affected component
Yamaha VOCALOID6 Editor
Event History
Oct 19, 2026
CVE Published
via MITRE·08:31 AM
Data Sourced
via MITRE·08:31 AM
DescriptionSeverity
Data Sourced
via NVD·09:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require an attacker to have access to an account on the affected device?
No. The vulnerability is rated with no privileges required, although exploitation requires user interaction.
2
Can an attacker trigger this without a user opening content?
No. Exploitation requires the affected product to load a specially crafted project file.