CVE-2026-105250: vgmstream Microsoft IMA Decoder RCE Flaw

CVE-2026-105250 Overview

CVE-2026-105250 is a divide-by-zero vulnerability [CWE-369] in vgmstream, an open-source audio decoding library used to play video game audio formats. The flaw resides in the decode_ms_ima function within src/coding/ima_decoder.c, part of the Microsoft Interactive Multimedia Association (IMA) Decoder component. Affected versions include vgmstream up to revision r2117. An attacker can trigger the condition by supplying a crafted audio file that causes a divisor to resolve to zero during decoding. The attack vector is network-based and requires user interaction to open or load the malicious file.

Critical Impact
Processing a specially crafted audio file causes the vgmstream decoder to abort through a divide-by-zero fault, resulting in a denial-of-service condition for applications or players that embed the library.

Affected Products

vgmstream audio library, versions up to and including r2117
Media players and front-ends that embed vgmstream for game audio playback
Microsoft IMA Decoder component (src/coding/ima_decoder.c)

Discovery Timeline

2026-10-05 - CVE-2026-105250 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105250

Vulnerability Analysis

vgmstream parses dozens of proprietary and standard audio containers used in video games. The Microsoft IMA Adaptive Differential Pulse Code Modulation (ADPCM) decoder relies on container-provided parameters such as frame size, channel count, and block alignment to compute per-sample decoding offsets. When one of these values is attacker-controlled and resolves to zero, the arithmetic operation inside decode_ms_ima performs a division by zero. The result is an unhandled floating-point or integer division exception that terminates the process consuming the library. Because vgmstream is embedded in third-party players and conversion tools, the fault propagates to any host application that attempts to decode the malicious stream.

Root Cause

The root cause is missing validation of a divisor value derived from untrusted file metadata before it is used in an arithmetic expression inside decode_ms_ima. The function assumes the parameter is non-zero and does not enforce a sanity check prior to the division operation. This matches the behavior described by CWE-369: Divide By Zero.

Attack Vector

Exploitation requires an attacker to deliver a malformed Microsoft IMA audio file to a victim who opens it with a vgmstream-enabled player or tool. Delivery mechanisms include email attachments, download links, shared game archives, and web-hosted media. No authentication is required. The outcome is limited to availability impact: a crash of the decoding process. Full technical details and discussion are available in GitHub Issue #1999 and the VulDB CVE-2026-105250 entry.

// No verified proof-of-concept code is published.
// The fault condition occurs inside decode_ms_ima() in
// src/coding/ima_decoder.c when a divisor derived from the
// input file resolves to zero and is used without validation.

Detection Methods for CVE-2026-105250

Indicators of Compromise

Unexpected crashes of media players, audio converters, or game-archive tools that embed vgmstream.
Process termination events accompanied by SIGFPE (Linux) or EXCEPTION_INT_DIVIDE_BY_ZERO (Windows) tied to vgmstream modules.
Receipt of unsolicited audio files targeting container formats handled by the Microsoft IMA decoder.

Detection Strategies

Monitor endpoint telemetry for repeated abnormal exits of processes that load the vgmstream library or its CLI (vgmstream-cli).
Hunt for inbound email or download activity delivering uncommon game audio extensions to users running vgmstream-enabled tools.
Correlate crash dumps against the decode_ms_ima call stack to confirm exposure to this specific flaw.

Monitoring Recommendations

Enable crash reporting and core dump collection on workstations that routinely decode game audio.
Track vgmstream version strings across managed assets to identify installations at or below revision r2117.
Review software inventory for third-party players such as foobar2000 plugins or conversion utilities that bundle vgmstream.

How to Mitigate CVE-2026-105250

Immediate Actions Required

Update vgmstream to a revision later than r2117 once the maintainers publish a fix referenced in GitHub Issue #1999.
Restrict opening untrusted audio files, especially Microsoft IMA ADPCM content delivered from external sources.
Audit endpoints and build pipelines for embedded copies of vgmstream and schedule upgrades for each one.

Patch Information

At the time of publication, the fix should be tracked through the vgmstream GitHub repository and the associated issue thread. Users who build vgmstream from source should pull the latest commit after a patched revision is merged. Downstream projects that vendor vgmstream must rebuild and redistribute their packages once the upstream fix is available.

Workarounds

Avoid decoding Microsoft IMA audio files from untrusted origins until a patched build is deployed.
Run vgmstream-based tools in sandboxed or containerized environments so that a crash does not disrupt other workloads.
Disable or remove vgmstream plugins from shared media players where decoding of arbitrary user-supplied files is not required.

bash

# Verify installed vgmstream revision and plan upgrades
vgmstream-cli -V

# Rebuild from latest upstream once the fix is merged
git clone https://github.com/vgmstream/vgmstream.git
cd vgmstream
git pull
./bootstrap  # or follow the project's current build instructions