CVE-2026-92880: vgmstream EA SCHl parser vadpcm_decoder.c vadpcm_read_coefs_be out-of-bounds write

Q: What capabilities does an attacker need to exploit this issue?

The attack vector is network-based and has low attack complexity. It does not require privileges, but it does require user interaction.

Q: How can I determine whether my deployment is affected?

Deployments using vgmstream releases up to r2117 are affected. Check the vgmstream revision in use and whether patch ae37662ad626254ddd96ad69ac263792d7a92024 has been applied.

Published Sep 17, 2026

Updated

A weakness has been identified in vgmstream up to r2117. Impacted is the function vadpcmreadcoefsbe of the file src/coding/vadpcmdecoder.c of the component EA SCHl parser. This manipulation of the argument entry/entries causes out-of-bounds write. Remote exploitation of the attack is possible. Patch name: ae37662ad626254ddd96ad69ac263792d7a92024. It is suggested to install a patch to address this issue.

Affected Software

1 affected component

vgmstream<=r2117

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch ae37662ad626254ddd96ad69ac263792d7a92024

Event History

Sep 17, 2026

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What capabilities does an attacker need to exploit this issue?

The attack vector is network-based and has low attack complexity. It does not require privileges, but it does require user interaction.

How can I determine whether my deployment is affected?