CVE-2026-105249: vgmstream Use After Free Vulnerability

CVE-2026-105249 Overview

CVE-2026-105249 is a use-after-free vulnerability in vgmstream, an open-source library for playing video game audio formats. The flaw resides in the make_group_random function within src/meta/txtp_process.c, part of the TXTP File Handler component. The issue affects vgmstream versions up to r2117 and requires local access with user interaction to trigger. The vulnerability is tracked under CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer. A fix is available in commit ae37662ad626254ddd96ad69ac263792d7a92024.

Critical Impact
Processing a maliciously crafted TXTP file can trigger a use-after-free condition in the vgmstream parser, potentially leading to memory corruption or application crash on the local host.

Affected Products

vgmstream library versions up to and including r2117
Applications and plugins embedding vgmstream (e.g., foobar2000, Winamp, Audacious plugins)
Any TXTP File Handler consumer invoking make_group_random

Discovery Timeline

2026-10-05 - CVE-2026-105249 published to the National Vulnerability Database
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-105249

Vulnerability Analysis

The vulnerability occurs in the make_group_random function in src/meta/txtp_process.c, which handles randomized grouping within TXTP configuration files. During group processing, the function references memory that has already been released, producing a use-after-free (UAF) condition classified under [CWE-119]. An attacker crafts a malformed TXTP file that forces the parser to free a buffer and then operate on the stale pointer during subsequent group randomization logic.

TXTP files are text-based playlists interpreted by vgmstream to describe how audio streams should be grouped, segmented, or layered. Because TXTP parsing runs with the privileges of the host application, successful exploitation yields local memory corruption in the player process.

Root Cause

The root cause is improper lifetime management of allocated group structures inside make_group_random. The function fails to invalidate or re-fetch a pointer after an underlying buffer has been freed during group reorganization. Related issues addressed in the same patch set include integer type mismatches (int versus size_t) in psx_decoder.c and insufficient entry-count validation in vadpcm_decoder.c.

Attack Vector

Exploitation requires local file access and user interaction. A victim must open, drag, or load a crafted .txtp file in an application that embeds vgmstream. The attack cannot be launched remotely over the network without a secondary delivery mechanism. No authentication beyond standard user privileges is required.

// Patch excerpt - src/coding/vadpcm_decoder.c
// Adds bounds validation before iterating coefficient entries
void vadpcm_read_coefs_be(VGMSTREAM* vgmstream, STREAMFILE* sf, off_t offset, int order, int entries, int ch) {

    if (entries < 1 || entries > 8 ) {
        VGM_LOG("VADPCM: wrong entries %i / order %i found\n", entries, order);
        return;
    }

    /* assumes all channels use same coefs, never seen non-mono files */
    for (int i = 0; i < entries * order * 8; i++) {
        vgmstream->ch[ch].vadpcm_coefs[i] = read_s16be(offset + i*2, sf);
    }
    vgmstream->codec_config = order;
}
// Source: https://github.com/vgmstream/vgmstream/commit/ae37662ad626254ddd96ad69ac263792d7a92024

// Patch excerpt - src/coding/psx_decoder.c
// Changes `int bytes` to `size_t bytes` to prevent integer overflow
    size_t interleave_consumed = 0;
    uint8_t buf[0x8000];
    int buf_pos = 0;
    size_t bytes;

    if (data_size == 0 || channels == 0 || (channels > 1 && interleave == 0))
// Source: https://github.com/vgmstream/vgmstream/commit/ae37662ad626254ddd96ad69ac263792d7a92024

Detection Methods for CVE-2026-105249

Indicators of Compromise

Unexpected crashes or segmentation faults in media players loading .txtp files
Presence of untrusted or newly introduced .txtp files in user media directories
Audio-player processes writing crash dumps shortly after opening TXTP playlists

Detection Strategies

Scan endpoints for vgmstream builds at or below revision r2117 and flag outdated plugin binaries
Hunt for .txtp files delivered via email attachments, archives, or shared drives from untrusted sources
Review file-handler associations for TXTP extensions on user workstations

Monitoring Recommendations

Monitor process-crash telemetry for audio applications such as foobar2000.exe, winamp.exe, and audacious
Collect file-creation events for .txtp extensions in download and temp directories
Alert on media-player processes spawning unexpected child processes or performing anomalous memory allocations

How to Mitigate CVE-2026-105249

Immediate Actions Required

Update vgmstream to a build that includes commit ae37662ad626254ddd96ad69ac263792d7a92024 or later
Rebuild and redistribute any downstream plugins or applications statically linking vgmstream
Restrict opening of TXTP files from untrusted sources until patched builds are deployed

Patch Information

The fix is available in the upstream repository via commit ae37662ad626254ddd96ad69ac263792d7a92024. Related discussion and the pull request are tracked in GitHub Issue #1998 and Pull Request #2008. Additional vulnerability metadata is published at VulDB CVE-2026-105249.

Workarounds

Disable or remove the vgmstream plugin from affected media players until updated
Block delivery of .txtp attachments through email and web gateways
Enforce application allow-listing to prevent execution of untrusted TXTP content

bash

# Verify installed vgmstream revision and update from source
git clone https://github.com/vgmstream/vgmstream.git
cd vgmstream
git log --oneline | grep ae37662
git checkout ae37662ad626254ddd96ad69ac263792d7a92024
# Build using the project's documented CMake or Makefile instructions