CVE-2026-86515: vgmstream txtp txtp_parser.c add_entry resource consumption
A security vulnerability has been detected in vgmstream up to r2117. Impacted is the function addentry of the file src/meta/txtpparser.c of the component txtp. Such manipulation of the argument rangestart/rangeend leads to resource consumption. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The name of the patch is 4b6a02dd1aff6428255db912563d77d4cb0a143e. It is advisable to implement a patch to correct this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vgmstream/txtpto a version that resolves this vulnerability.Patch 4b6a02dd1aff6428255db912563d77d4cb0a143e - Compensating control
Restrict network access to any service or interface that could reach vgmstream remote inputs, since the attack may be performed from remote and the exploit is publicly disclosed.
Event History
Frequently Asked Questions
Which deployments are affected?
vgmstream versions up to r2117 are affected, specifically the txtp component's add_entry function in src/meta/txtp_parser.c.
What must an attacker do to trigger the issue?
The issue is triggered by manipulating the range_start and range_end arguments. The attack can be performed remotely and requires user interaction, according to the supplied severity vector.
What is the practical impact?
Successful exploitation causes resource consumption, resulting in an availability impact. The supplied vector indicates no confidentiality or integrity impact.
Is exploit code available?
Yes. The exploit has been publicly disclosed and may be used.
What remediation is identified?
Apply the patch identified as 4b6a02dd1aff6428255db912563d77d4cb0a143e.