CVE-2026-92879: vgmstream mus_acm.c parse_mus resource consumption
A security flaw has been discovered in vgmstream up to r2117. This issue affects the function parsemus of the file src/meta/musacm.c. The manipulation results in resource consumption. The attack may be launched remotely. The patch is identified as ae37662ad626254ddd96ad69ac263792d7a92024. Applying a patch is advised to resolve this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vgmstreamto a version that resolves this vulnerability.Patch ae37662ad626254ddd96ad69ac263792d7a92024 - Compensating control
Since the flaw can be launched remotely and results in resource consumption during parse_mus (src/meta/mus_acm.c), limit remote access to services that process vgmstream/parse_mus inputs and add rate limiting/controls to reduce resource-exhaustion impact.
Event History
Frequently Asked Questions
Which deployments are potentially affected?
vgmstream versions up to r2117 are identified as affected. Deployments that process untrusted content remotely may be exposed to the resource-consumption condition.
What does exploitation require?
The issue can be launched remotely and does not require attacker privileges. User interaction is required, consistent with processing attacker-influenced content through the affected functionality.
What is the expected impact?
Successful exploitation causes resource consumption and is rated as having low availability impact. No confidentiality or integrity impact is indicated by the supplied severity vector.
What should be done if an affected version is in use?
Apply the patch identified as ae37662ad626254ddd96ad69ac263792d7a92024. To identify potentially affected installations, check whether the deployed vgmstream version is r2117 or earlier and whether the patch has been incorporated.