CVE-2026-86514: vgmstream txth-txtp txth.c sscanf stack-based overflow
A weakness has been identified in vgmstream up to r2117. This issue affects the function sscanf of the file src/meta/txth.c of the component txth-txtp. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Patch name: 4669d37a6af94866f6f0628678f9f90d46954e8b. To fix this issue, it is recommended to deploy a patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vgmstream txth-txtp (src/meta/txth.c sscanf)to a version that resolves this vulnerability.Fixed in r2117Patch 4669d37a6af94866f6f0628678f9f90d46954e8b
Event History
Frequently Asked Questions
Which vgmstream versions should be considered affected?
The issue is reported to affect vgmstream through r2117. The provided data identifies patch 4669d37a6af94866f6f0628678f9f90d46954e8b as the remediation.
What does an attacker need to exploit this issue?
The attack can be carried out remotely and has low attack complexity, with no privileges required. User interaction is required.
Is public exploit information available?
Yes. The exploit has been made publicly available and could be used in attacks.
What should teams do if they are running an affected version?
Deploy patch 4669d37a6af94866f6f0628678f9f90d46954e8b. The vulnerability is a stack-based buffer overflow in sscanf within src/meta/txth.c in the txth-txtp component.