CVE-2026-105248: vgmstream TXTP Parser Buffer Overflow

CVE-2026-105248 Overview

CVE-2026-105248 is an out-of-bounds write vulnerability in vgmstream, an open-source library for playing streamed audio from video games. The flaw resides in the parse_params and txtp_parse functions located in src/meta/txtp_parser.c, which handle TXTP file parsing. An attacker can trigger memory corruption by supplying a crafted TXTP file to the parser. The issue affects vgmstream releases up to revision r2117 and is tracked under [CWE-119] (improper restriction of operations within the bounds of a memory buffer). The upstream project has published commit 4669d37a6af94866f6f0628678f9f90d46954e8b to address the overflow.

Critical Impact
Processing a malicious TXTP file can write past buffer boundaries in the vgmstream parser, enabling memory corruption and potential code execution within the host application.

Affected Products

vgmstream up to revision r2117
src/meta/txtp_parser.c TXTP file handler component
Applications and plugins that embed vgmstream for audio decoding

Discovery Timeline

2026-10-05 - CVE-2026-105248 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105248

Vulnerability Analysis

The vulnerability occurs inside the TXTP parser used by vgmstream to read playlist-style configuration files describing audio streams. The functions parse_params and txtp_parse in src/meta/txtp_parser.c tokenize key/value pairs from text lines but do not consistently cap how many characters sscanf writes into fixed-size buffers. When input tokens exceed the expected key or value length, writes extend past the destination buffer. This is classified as an out-of-bounds write under [CWE-119].

Because TXTP files are plain text configuration data that reference audio streams, they are often distributed alongside game audio packs or downloaded from community repositories. A victim who opens or imports an attacker-supplied TXTP file in any application linked against vulnerable vgmstream can trigger the corruption.

Root Cause

The parser defined line, key, and value size macros (TXT_LINE_MAX, TXT_LINE_KEY_MAX, TXT_LINE_VAL_MAX) but did not pass matching width specifiers to sscanf. Without explicit field widths, sscanf writes the full token into the destination regardless of its declared size, allowing one field to overflow the next or overrun the stack frame.

Attack Vector

Exploitation is remote in the sense that the malicious file can be delivered over the network, but it requires user interaction: the victim must load the crafted TXTP file into an application that uses vgmstream. No authentication is required.

// Patch excerpt from src/meta/txtp_parser.c
#define TXT_LINE_MAX 2048 /* some wwise .txtp get wordy */
#define TXT_LINE_KEY_MAX 128
#define TXT_LINE_VAL_MAX (TXT_LINE_MAX - TXT_LINE_KEY_MAX)
// sscanf needs buf maxs when key/val aren't as big as line
#define TXT_LINE_STR "2047"
#define TXT_LINE_KEY_STR "127"
#define TXT_LINE_VAL_STR "1919"

/*******************************************************************************/
/* PARSER - HELPERS                                                            */

Source: GitHub Commit 4669d37. The patch introduces explicit width-limit string macros that are passed to sscanf format specifiers so writes cannot exceed buffer capacity.

Detection Methods for CVE-2026-105248

Indicators of Compromise

TXTP files containing abnormally long key or value tokens exceeding 128 and 1919 characters respectively
Crash reports or core dumps from processes linked against vgmstream when parsing audio playlist files
Unexpected memory access violations originating from the txtp_parse or parse_params functions

Detection Strategies

Inventory applications and plugins that bundle vgmstream and verify whether their build predates commit 4669d37a6af94866f6f0628678f9f90d46954e8b
Scan file shares and user download directories for .txtp files from untrusted origins and inspect line lengths
Monitor host telemetry for crashes or unusual child-process behavior in audio-processing utilities

Monitoring Recommendations

Enable Address Sanitizer (ASan) builds of vgmstream in test environments to surface overflow conditions during QA
Alert on EDR process-exit events tied to media players or audio tooling with abnormal termination codes
Log and review opens of .txtp files delivered via email, chat, or community download channels

How to Mitigate CVE-2026-105248

Immediate Actions Required

Update vgmstream to a build that includes commit 4669d37a6af94866f6f0628678f9f90d46954e8b or later
Rebuild and redistribute any downstream application, plugin, or packaged binary that statically links vgmstream
Restrict loading of TXTP files to known-trusted sources until patched builds are deployed

Patch Information

The upstream fix is published in the vgmstream GitHub repository as commit 4669d37. The patch adds sscanf width-limit macros (TXT_LINE_STR, TXT_LINE_KEY_STR, TXT_LINE_VAL_STR, and the multitxth TXT_PATH_LIMIT_STR) to constrain writes in both src/meta/txth.c and src/meta/txtp_parser.c. Tracking details are available at the VulDB CVE-2026-105248 entry and the related GitHub Issue #1997.

Workarounds

Avoid opening TXTP files from untrusted or unverified sources
Sandbox audio decoding processes using OS-level isolation such as seccomp, AppArmor, or Windows AppContainer
Strip or reject TXTP attachments at email and file-sharing gateways until patched versions are in use

bash

# Build vgmstream from source with the fix applied
git clone https://github.com/vgmstream/vgmstream.git
cd vgmstream
git checkout 4669d37a6af94866f6f0628678f9f90d46954e8b
mkdir build && cd build
cmake .. -DBUILD_CLI=ON
cmake --build . --config Release