CVE-2026-111150: ValleyBell libvgm through commit a6eed945 Heap Out-of-Bounds Read via DecompressDataBlk
ValleyBell libvgm through commit a6eed945 contains a heap out-of-bounds read vulnerability in the PCM data-block decompressor caused by an unbounded compression-table index. Attackers can supply a crafted .vgm file with a small type 0x7F table and wider compressed values, causing DecompressDataBlk to over-read heap memory and crash consumers.
Affected Software
Event History
Frequently Asked Questions
What must an attacker provide to trigger the issue?
The attacker must supply a crafted .vgm file containing a type 0x7F compression table that is small relative to the compressed values it references. Processing that file can cause the PCM data-block decompressor to read beyond a heap allocation.
What is the practical impact on an affected consumer?
The described impact is a crash of a consumer that processes the crafted .vgm file, resulting in denial of service. The provided data does not establish confidentiality or integrity impact.
Which deployments are exposed?
Consumers of ValleyBell libvgm through commit a6eed945 that process attacker-controlled or otherwise untrusted .vgm files are exposed. Exploitation requires local access and user interaction, as reflected by the supplied CVSS vector.