CVE-2026-86515: vgmstream txtp Parser DoS Vulnerability

CVE-2026-86515 Overview

CVE-2026-86515 is a resource consumption vulnerability in vgmstream up to revision r2117. The flaw resides in the add_entry function within src/meta/txtp_parser.c, part of the txtp component. Manipulation of the range_start and range_end arguments triggers uncontrolled resource consumption [CWE-400]. The issue has been publicly disclosed and a patch is available in commit 4b6a02dd1aff6428255db912563d77d4cb0a143e. vgmstream is an audio decoding library used to play video game audio formats, commonly integrated into media players and audio conversion utilities.

Critical Impact
Remote attackers can supply crafted .txtp files that cause excessive resource consumption in applications embedding vulnerable versions of vgmstream, leading to a limited availability impact.

Affected Products

vgmstream audio decoding library up to revision r2117
Applications and media players embedding vulnerable vgmstream builds
Downstream distributions packaging vgmstream prior to commit 4b6a02dd

Discovery Timeline

2026-09-08 - CVE-2026-86515 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86515

Vulnerability Analysis

The vulnerability is a resource exhaustion flaw [CWE-400] in the vgmstream text playlist (txtp) parser. The add_entry function in src/meta/txtp_parser.c processes range parameters supplied through .txtp playlist files. When an attacker supplies crafted range_start and range_end values, the parser expands the range without adequate bounds enforcement, driving excessive memory or CPU consumption.

Exploitation requires the victim to open a malicious .txtp file through an application that embeds vgmstream. The attack vector is network-adjacent in the sense that the crafted file can be delivered remotely, but user interaction is required to load the file. Successful exploitation degrades availability of the parsing process without affecting confidentiality or integrity.

Root Cause

The root cause is missing validation of the range_start and range_end inputs prior to entry allocation and iteration within add_entry. The parser trusts caller-supplied bounds when expanding playlist entries. An attacker-controlled range therefore translates directly into allocation and loop pressure inside the decoder. Related buffer handling issues in src/coding/hca_decoder.c and src/coding/imuse_decoder.c were addressed in the same fix commit.

Attack Vector

Delivery occurs through a crafted .txtp file distributed via web download, chat, email attachment, or archive. The victim opens the file in an application that links against vulnerable vgmstream. The parser then executes add_entry with hostile range values, exhausting available resources for the process context. No authentication or elevated privileges are required.

/* Patch excerpt from src/coding/hca_decoder.c
 * Adds a missing allocation failure check before use.
 * Source: https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e
 */

    /* init library handle */
    data->handle = calloc(1, clHCA_sizeof());
+   if (!data->handle) goto fail;
+
    clHCA_clear(data->handle);

    status = clHCA_DecodeHeader(data->handle, header_buffer, header_size); /* parse header */

/* Patch excerpt from src/coding/imuse_decoder.c
 * Introduces a defined maximum PCM buffer size to bound allocations.
 * Source: https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4cb0a143e
 */

#define MAX_BLOCK_SIZE 0x2000
#define MAX_BLOCK_COUNT 0x10000     // arbitrary max
#define BLOCK_COUNT_AIFC 0x2000     // observed max
+#define PCM_BUF_SIZE (MAX_BLOCK_SIZE / sizeof(short) * MAX_CHANNELS) //a block could be all PCM

Detection Methods for CVE-2026-86515

Indicators of Compromise

Sustained high CPU or memory usage in processes hosting vgmstream after opening a .txtp file.
Presence of .txtp files with unusually large range_start or range_end values in downloads or user profile directories.
Application crashes or hangs correlated with playlist parsing activity in vgmstream-backed players.

Detection Strategies

Inspect .txtp files at the gateway for range parameters that exceed expected playlist sizes.
Monitor vgmstream-linked processes for anomalous resource growth during file parse operations.
Track deployment of vgmstream binaries and libraries against the fixed commit 4b6a02dd to identify vulnerable builds.

Monitoring Recommendations

Alert on media applications consuming abnormal memory shortly after file open events.
Log and review .txtp file downloads from untrusted sources through email, web, and messaging channels.
Baseline normal parser runtimes and flag executions that exceed the baseline by significant margins.

How to Mitigate CVE-2026-86515

Immediate Actions Required

Update vgmstream to a build that includes commit 4b6a02dd1aff6428255db912563d77d4cb0a143e or later.
Rebuild and redistribute downstream applications that statically link vgmstream against the patched sources.
Restrict opening of .txtp files sourced from untrusted origins until patches are deployed.

Patch Information

The fix is available in the vgmstream repository under commit 4b6a02dd1aff6428255db912563d77d4cb0a143e. The change hardens buffer handling in the HCA and iMUSE decoders and addresses the add_entry range handling in src/meta/txtp_parser.c. See the vgmstream patch commit, the related pull request, and the upstream issue #1973 for technical context. Additional metadata is available at VulDB CVE-2026-86515.

Workarounds

Block or quarantine .txtp files at email and web gateways when patching is not immediately possible.
Run vgmstream-linked players inside sandboxes or containers with strict memory and CPU quotas.
Disable playlist parsing features in applications that expose vgmstream to untrusted input.

bash

# Verify installed vgmstream commit against the fixed revision
cd /path/to/vgmstream
git log --oneline | grep 4b6a02dd

# Update and rebuild against the patched sources
git fetch origin
git checkout 4b6a02dd1aff6428255db912563d77d4cb0a143e
make clean && make