CVE-2026-76137: Low severity VOCALOID6 Editor vulnerability
Missing authentication for critical function vulnerability exists in VOCALOID6. Any process running under the same local user account as a running VOCALOID6 Editor instance may escalate privileges via a local named pipe.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems with a running VOCALOID6 Editor instance are exposed to other processes operating under the same local user account. The issue is local rather than remotely reachable.
What does an attacker need to exploit it?
An attacker needs the ability to run a process under the same local user account as the user running VOCALOID6 Editor. Exploitation occurs through a local named pipe and does not require user interaction.
How can I reduce exposure before applying an update?
Limit execution of untrusted programs under accounts that run VOCALOID6 Editor, and avoid running the editor while such processes may be present. Separating work into different local user accounts also prevents the stated same-account condition.