CVE-2026-86514: vgmstream Buffer Overflow Vulnerability

CVE-2026-86514 Overview

CVE-2026-86514 is a stack-based buffer overflow in vgmstream up to revision r2117. The flaw resides in the sscanf call within src/meta/txth.c, part of the txth-txtp component used to parse text-based audio metadata files. Manipulating input passed to sscanf without proper width specifiers overflows fixed-size stack buffers. The issue is tracked under [CWE-119] and has been publicly disclosed with a fix committed as 4669d37a6af94866f6f0628678f9f90d46954e8b. Exploitation requires user interaction, since a victim must open a crafted .txth or .txtp file. See VulDB CVE-2026-86514 for the reference entry.

Critical Impact
A crafted TXTH or TXTP file can trigger a stack-based buffer overflow in vgmstream, corrupting adjacent stack memory and potentially enabling code execution or process crash.

Affected Products

vgmstream up to revision r2117
src/meta/txth.c (txth-txtp component)
src/meta/txtp_parser.c (related parser with same overflow class)

Discovery Timeline

2026-09-08 - CVE-2026-86514 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86514

Vulnerability Analysis

vgmstream is an audio decoding library used by media players and game audio tools to parse a wide range of streamed audio formats. The txth and txtp parsers consume plain-text descriptor files that define how raw audio streams should be interpreted. Parsing relies on sscanf with %s conversions that lack explicit maximum-width specifiers.

When a crafted descriptor file contains tokens longer than the destination stack buffers, sscanf writes past the buffer boundary. The result is stack memory corruption that can overwrite saved registers, return addresses, or adjacent locals. Because the attack vector is network-reachable content delivered through a media file, an attacker can host a malicious file and rely on user interaction to trigger the flaw.

Root Cause

The root cause is missing field-width limits in sscanf format strings that write into stack buffers defined by TXT_LINE_MAX, TXT_LINE_KEY_MAX, and TXT_LINE_VAL_MAX. Without width caps such as %127s or %2047s, oversized input tokens overflow their destination arrays. This is a classic [CWE-119] boundary violation in C string handling.

Attack Vector

Exploitation requires an attacker to deliver a crafted .txth or .txtp file and induce a user to open it in an application linked against a vulnerable vgmstream build. Because vgmstream is embedded in audio players and game modding tools, malicious descriptors can be distributed through websites, file-sharing platforms, or bundled with audio archives.

// Patch: introduce explicit sscanf width limits to prevent stack overflow
// Source: https://github.com/vgmstream/vgmstream/commit/4669d37a6af94866f6f0628678f9f90d46954e8b
#define TXT_LINE_MAX 2048 /* probably ~1000 would be ok */
#define TXT_LINE_KEY_MAX 128
#define TXT_LINE_VAL_MAX (TXT_LINE_MAX - TXT_LINE_KEY_MAX)
// sscanf needs buf maxs if key/val aren't as big as line
#define TXT_LINE_STR "2047"
#define TXT_LINE_KEY_STR "127"
#define TXT_LINE_VAL_STR "1919"
// multitxth
#define TXT_PATH_LIMIT_MAX 4096 //PATH_LIMIT
#define TXT_PATH_LIMIT_STR "4095"

The patch defines string-literal width caps that are concatenated into sscanf format strings, ensuring writes never exceed the destination buffer size. An equivalent fix is applied in src/meta/txtp_parser.c.

Detection Methods for CVE-2026-86514

Indicators of Compromise

Unexpected crashes or SIGSEGV in processes that load vgmstream when opening .txth or .txtp files.
Presence of .txth or .txtp files with abnormally long single-line tokens exceeding 128 characters for keys or 2048 characters per line.
Media player or game audio tool binaries linked against vgmstream builds at or before r2117.

Detection Strategies

Inventory endpoints for applications that embed vgmstream and identify installed revisions relative to commit 4669d37a6af94866f6f0628678f9f90d46954e8b.
Scan file shares and download directories for .txth and .txtp files that contain oversized token lengths inconsistent with legitimate descriptors.
Fuzz local builds of vgmstream with malformed descriptors using AddressSanitizer to surface stack overflow signatures.

Monitoring Recommendations

Monitor process telemetry for crashes originating from vgmstream parsing routines in txth.c and txtp_parser.c.
Track downloads of audio archives from untrusted sources that include .txth or .txtp descriptor files.
Alert on new or modified vgmstream binaries deployed to systems outside of expected software distribution channels.

How to Mitigate CVE-2026-86514

Immediate Actions Required

Update vgmstream to a build that includes commit 4669d37a6af94866f6f0628678f9f90d46954e8b or later.
Rebuild and redeploy any downstream applications, plugins, or players that statically link the vulnerable vgmstream source.
Restrict opening .txth and .txtp files from untrusted origins until affected software is patched.

Patch Information

The upstream fix is available in the GitHub commit 4669d37 and referenced in GitHub Pull Request #1956 and GitHub Issue #1972. Rebuild from the patched revision of the GitHub vgmstream Repository and redistribute updated binaries to affected endpoints.

Workarounds

Block delivery of .txth and .txtp files through email gateways and web proxies where feasible.
Configure media players and audio tools to disable vgmstream-based decoders until updated.
Sandbox media applications that must process untrusted audio descriptors to contain the impact of a stack corruption event.

bash

# Build vgmstream from the patched revision
git clone https://github.com/vgmstream/vgmstream.git
cd vgmstream
git checkout 4669d37a6af94866f6f0628678f9f90d46954e8b
cmake -B build -S . -DCMAKE_BUILD_TYPE=Release
cmake --build build --parallel