CVE-2026-110660: vgmstream through r2117 Stack Out-of-Bounds Read via G.722.1/Siren14 Decoder
vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the G.722.1/Siren14 decoder in g7221lib.c, whose bit reader refills without checking the datau32 array end. Attackers can supply crafted .s14 or .sss files that drive decodevectorquantizedmltindices() past the stack buffer during format detection, crashing the application.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using vgmstream through r2117 are exposed when they process attacker-controlled .s14 or .sss audio files. The vulnerable decoder can be reached during format detection, so playback is not necessarily required.
What must an attacker do to trigger the flaw?
An attacker must provide a crafted .s14 or .sss file and have the target application inspect it with the affected vgmstream code. The published vector indicates local attack access and user interaction are required.
What is the practical impact?
The described result is an application crash caused by a stack out-of-bounds read. The supplied severity vector reports no confidentiality or integrity impact and a low availability impact.